Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Getting Data In
Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
Options
- Mark all as New
- Mark all as Read
- Float this item to the top
- Subscribe
- Bookmark
- Subscribe to RSS Feed
- Threaded format
- Linear Format
- Sort by Topic Start Date
Discussions
| Thread Info | |||||
|---|---|---|---|---|---|
|
All of my events show up with gid=-1,uid=-1. Is this a bug or am I doing something wrong?
by
oreoshake
Communicator
in
Getting Data In
03-18-2010
|
1
|
3
| ||
|
|
UPDATE: This appears to be a bug specifically related to 4.0.10. The following is a work around in system/local/input...
by
oreoshake
Communicator
in
Getting Data In
03-30-2010
|
1
|
3
| ||
|
|
I have lots of hosts in my environment, but I only want to search across a few of them from time to time. Can I someh...
by
maverick
Splunk Employee
in
Getting Data In
03-30-2010
|
1
|
2
| ||
|
|
We have an global application hosted within a VM environment feeding a common Splunk index server. However the server...
by
matt_1
Explorer
in
Getting Data In
03-29-2010
|
0
|
2
| ||
|
|
Everytime I run a splunk command on windows 7, the command runs in a separate window and closes before I can see what...
by
oreoshake
Communicator
in
Getting Data In
03-29-2010
|
1
|
2
| ||
|
|
Hai There,
I am dealing with a forwarder to indexer which is reading a kiwi directory with several types of device...
by
Starlette
Contributor
in
Getting Data In
03-28-2010
|
1
|
2
| ||
|
|
Does a sinkhole work on all types of forwarders?
by
Michael_Wilde
Splunk Employee
in
Getting Data In
03-29-2010
|
3
|
1
| ||
|
|
How to disable hostname chaining? Splunk picks the chained hostname rather than the original.
by
zliu
Splunk Employee
in
Getting Data In
03-26-2010
|
0
|
1
| ||
|
|
I have a light forwarder (v4.0.7) I want to change this to a forwarder instead of a light forwarder. The reason being...
by
Alan_Bradley
Path Finder
in
Getting Data In
03-25-2010
|
0
|
3
| ||
|
|
We're upgrading our forwarders and we always get the warning that outputs.conf cannot be migrated. However, simply mo...
by
oreoshake
Communicator
in
Getting Data In
03-19-2010
|
0
|
1
| ||
|
|
When we build 2 Splunk indexing servers for High Availablity, 2 Splunk indexing servers may receive the same log data...
by
Alan_Bradley
Path Finder
in
Getting Data In
03-19-2010
|
0
|
1
| ||
|
|
We plan to use Splunk to keep log for several java application including web server like Tomcat. Those application ar...
by
Alan_Bradley
Path Finder
in
Getting Data In
03-19-2010
|
2
|
1
| ||
|
|
Why would there be a gap of logged events in metrics.log between 01-21-2010 15:47:39.421 and 01-22-2010 08:53:28.231 ...
by
hulahoop
Splunk Employee
in
Getting Data In
01-23-2010
|
0
|
5
| ||
|
|
This is related to an earlier question: http://answers.splunk.com/questions/490/why-do-variations-in-sourcetype-appea...
by
Glenn
Builder
in
Getting Data In
03-18-2010
|
2
|
5
| ||
|
|
I'm concerned about CLI and REST authentication tokens. How long do those stay valid and is it configurable?
by
Alan_Bradley
Path Finder
in
Getting Data In
03-19-2010
|
2
|
1
| ||
|
|
Are queries that go to two index servers in different time zones handled correctly? I'm assuming it does, but want to...
by
Alan_Bradley
Path Finder
in
Getting Data In
03-19-2010
|
0
|
1
| ||
|
|
I do not see in any of the manuals or Help how to add host servers. You label the targets as Host on the main page bu...
by
Alan_Bradley
Path Finder
in
Getting Data In
03-19-2010
|
1
|
1
| ||
|
|
If a size- or time-based retention policy is set via maxTotalDataSizeMB or frozenTimePeriodInSecs in indexes.conf, ho...
by
hulahoop
Splunk Employee
in
Getting Data In
03-13-2010
|
3
|
2
| ||
|
|
How can I set up Splunk to automatically open troubletickets?
by
SteveS
Splunk Employee
in
Getting Data In
03-15-2010
|
1
|
1
| ||
|
|
Installed Splunk on Windows machine and in the task manager I see these two processes running by default. How can I d...
by
elusive
Splunk Employee
in
Getting Data In
03-13-2010
|
2
|
2
| ||
|
Hi
I am trying to filter events on a LightWeightForwarder, but they don't get dropped. Is there a way to debug thi...
by
chris
Motivator
in
Getting Data In
03-12-2010
|
1
|
4
| ||
|
|
If I have a field value that is URL encoded then base-64 encoded, is it possible to have Splunk decode this field bef...
by
hulahoop
Splunk Employee
in
Getting Data In
03-08-2010
|
3
|
7
| ||
|
|
Apart from the fact that a lightforwarder does not have a web UI, what are the main differences between the 2 apps?
by
Mick
Splunk Employee
in
Getting Data In
03-09-2010
|
0
|
2
| ||
|
|
Hi
I have set up a light weight forwarder that appears to be getting data to the indexer. But I can't search for ...
by
chris
Motivator
in
Getting Data In
03-03-2010
|
2
|
2
| ||
|
|
I need to do the following on my forwarder:
Forward all data received and gathered by the forwarder to Splunk inde...
by
Alan_Bradley
Path Finder
in
Getting Data In
02-22-2010
|
1
|
1
|
Get Started
Explore Essential Splunk Resources
Get Expert Help at Community Office Hours
Join the #getting-data-in Slack channel
Get Expert Help at Community Office Hours
Join the #getting-data-in Slack channel
Become An Expert
Top Labels
-
add-on
2 -
administration
11 -
AIX
1 -
audit
1 -
blacklist
90 -
CLI
1 -
configuration
28 -
CSV
202 -
data
423 -
development
5 -
encryption
1 -
eval
2 -
field extraction
531 -
fields
4 -
forwarder
1 -
forwarder management
3 -
heavy
1 -
heavy forwarder
884 -
host
151 -
HTTP Event Collector
418 -
index
523 -
indexer
670 -
indexing performance
1 -
inputs.conf
801 -
installation
4 -
intermediate forwarder
132 -
introduction
3 -
JSON
376 -
kvstore
1 -
Linux
427 -
login
1 -
Mac
29 -
metadata
1 -
metrics
2 -
modular input
179 -
monitor
301 -
monitoring console
1 -
other
15 -
proactive Splunk component monitoring
2 -
props.conf
926 -
regex
5 -
saved search
2 -
scripted input
237 -
search
1 -
search head
2 -
source
279 -
sourcetype
467 -
Splunk Enterprise
1 -
Splunk Investigate
1 -
splunk-assist
2 -
subsearch
1 -
syslog
298 -
time
202 -
transforms.conf
546 -
troubleshooting
15 -
universal forwarder
1,496 -
using Enterprise Security
3 -
using Splunk Cloud
4 -
using Splunk Enterprise
14 -
whitelist
60 -
Windows
566 -
XML
89
- « Previous
- Next »
Get Updates on the Splunk Community!
Detecting Cross-Channel Fraud with Splunk
This article is the final installment in our three-part series exploring fraud detection techniques using ...
Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside
Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...
Splunk App Dev Community Updates – What’s New and What’s Next
Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...
