Getting Data In

Community Activity

How do I find timestamp recognition discrepancies in my events? I seem to have some events that were where not given the correct timestamp. I'm trying to track down how/why this is... by Lowell Super Champion in Getting Data In 10-13-2010 1 2	1	2
List the files being monitored with listtails in 4.1.1 The command below used to work on previous versions (4.0.8), but now that I have upgraded, I get the error below. ... by seanlon11 Path Finder in Getting Data In 10-12-2010 1 2	1	2
csv lookup on aliased field I am trying to setup a csv lookup for data enrichment on an Aliased field. original field name dstport aliased to de... by EricPartington Communicator in Getting Data In 10-12-2010 0 2	0	2
new to splunk, wanting to monitor client's sbs boxes automatically Hi, im posting from a small IT company who looks after x amount of clients. We want to be able to have splunk monitor... by adamgardner New Member in Getting Data In 10-12-2010 0 3	0	3
Group events by unique ID then time from start to finish Hi, I have a need to time certain events in my logs. We have the log format as below. What I need to be able to do ... by username_user New Member in Getting Data In 10-12-2010 0 6	0	6
Exception: The following XML navigation configuration for this app is invalid: xmlParseEntityRef: no name, line 6, column 34 What does this mean? My /nav/default.xml looks like: <nav> <view name="Introduction" default="true"/> <colle... by Dan Splunk Employee in Getting Data In 10-11-2010 1 1	1	1
Segmenting/ignoring selective data from a server we don't own I have a question that I'm looking for some guidance on. Our division has a team that's interested in data that sits... by mfrost8 Builder in Getting Data In 10-11-2010 1 6	1	6
New CSV files are being seen, but not indexed I am working on adding large CSV files into splunk. Here is an example csv file: TimeStamp,Transport Overload,Core O... by msarro Builder in Getting Data In 10-11-2010 0 6	0	6
Index monitored file initially Hi, it seems like this should be something simple, but I was unable to find this anywhere in the documentation or pas... by gallantalex Path Finder in Getting Data In 10-11-2010 0 2	0	2
Monitor Registry and Forward Data Past two day I have been working on modifying a Splunk forwarder configuration to monitor a certain registries. After... by gallantalex Path Finder in Getting Data In 10-11-2010 0 2	0	2
Index XML log files Hi, I'm trying out splunk for the first time (4.1.5) as a tool for chewing up audit logs. These logs are written out... by SplunkMe Engager in Getting Data In 10-08-2010 2 2	2	2
File no longer monitored I have a tomcat log file that I was monitoring (catalina.out). This was working fine until it stopped working on Octo... by Branden Builder in Getting Data In 10-08-2010 0 6	0	6
How do I determine when an event was indexed? I'm trying to troubleshoot some issues with indexing. It would be great to be able to find out when an event or even... by the_wolverine Champion in Getting Data In 10-08-2010 5 5	5	5
Filtering input data from a udp syslog port I need some help filtering data from a udp (port 514) syslog input. I know the source IP and I assume I will need a ... by rhuss Engager in Getting Data In 10-08-2010 0 1	0	1
mysql service monitor Hi, I need to monitor all the changes of a mysql server including data, tables, indexings and every thing. how can i... by Jaina New Member in Getting Data In 10-08-2010 0 2	0	2
WMI queries using the LightWeightFowarder hammering each server every second with 5 to 10 per second I am being told that was the default. I am seeing over 2 Billion WMI records, most (1.6 B) are from WMI:LocalProcess... by billconnell Engager in Getting Data In 10-07-2010 0 1	0	1
Filter subset of a sourcetype at forwarder? I have a DC that forwards a huge amount of wineventlog:Security events to my indexer. I want to configure the forwar... by muebel SplunkTrust in Getting Data In 10-07-2010 0 3	0	3
Monitor Windows Registry from Remote Server Hi, I know I am able to monitor the registry on the local machine where Splunk is run. How about if I want Splunk to ... by gallantalex Path Finder in Getting Data In 10-07-2010 0 2	0	2
Correct syntax for syslog source in props.conf for SEDCMD I would like to ensure that ssn's are anonymized, can anyone tell me what the source type should be for syslog? In t... by jbertoli Engager in Getting Data In 10-07-2010 0 1	0	1
Newbie Question - CSV with header Hey everyone. First, thanks for helping with all of my newbie questions, I really appreciate it. Right now I am tryin... by msarro Builder in Getting Data In 10-07-2010 0 2	0	2
Can splunk convert input files contents from Hexadecimal to Decimal? Specifically monitoring a AppServer that outputs to a file storing in hexadecimal format. Can we specify the charset ... by Chris_R_ Splunk Employee in Getting Data In 10-07-2010 0 4	0	4
Splunk not indexing some files Hello, I am trying to index some files from a lightforwarder on a unix directory (HP-UX), by writing a proper inputs.... by cafissimo Communicator in Getting Data In 10-07-2010 0 2	0	2
Event trigger; followed by a wait window; followed by a notification trigger I have a customer who his trying to port over to Splunk from their "home grown" scripting. The request goes like this... by MasterOogway Communicator in Getting Data In 10-06-2010 0 2	0	2
forwarding accross networks Do to Security requirements I need to setup a forwarder between two networks, say A and B. My Splunk server is on net... by arcotops New Member in Getting Data In 10-06-2010 0 1	0	1
Why does Splunk have multiple indexes? With Splunk's normalizing timestamp-based event indexing capabilities combined with it's powerful search language and... by maverick Splunk Employee in Getting Data In 10-06-2010 6 6	6	6