Getting Data In

Community Activity

How to get linux logs to blacklist in input.conf? Hi Team, getting huges audit logs and wanted to blacklist in input.conf . index=linux source="/var/log/audit/audit... by shashilendra Explorer in Getting Data In 12-27-2022 0 5	0	5
How to write a Splunk search to get to a field value that belongs to particular field? Good day, i am using search query to correlate one field belongs and related jobs for that field i am using below que... by sekhar463 Path Finder in Getting Data In 12-26-2022 0 1	0	1
What are the best practices for defining source types? I've heard that using Splunk's default source type detection is flexible, but can be hard on performance. What is the... by sloshburch Ultra Champion in Getting Data In 12-25-2022 0 17	0	17
Getting in the commands from cisco devices Hi, I collected the cisco deviceslog with "Cisco Networks Add-on for Splunk Enterprise". And install "Cisco Networks... by m_zandinia Path Finder in Getting Data In 12-24-2022 0 0	0	0
TIME_PREFIX configuration is not working Hi All,We are working in Splunk Cloud environment, I want to deploy custom the TIME_PREFIX configuration for one of t... by bhsakarchourasi Path Finder in Getting Data In 12-23-2022 0 2	0	2
Why does the indexer peer node takes hours to join cluster? I have a case where some indexers take 4 to 5 hours to join the cluster. The system shows no/little system usage (CP... by mdtoro Explorer in Getting Data In 12-23-2022 0 3	0	3
Servicenow Integration I have setup servicenow to splunk integration and coming to the inputs, I have turned on the Splunk sys user group a... by Roy_9 Motivator in Getting Data In 12-23-2022 0 0	0	0
Splunk rejects syslog messages Hello, everyoneI've "all-in-one" splunk installation, configured syslog input, but input messages are rejected.Below ... by bosseres Contributor in Getting Data In 12-23-2022 1 1	1	1
How to pass conditional field names for a field in props.conf stanza? There is a threat log with 2 sub_types (url and vulnerability) and sample data are as below.panwlogs-,2022-12-15T08:4... by divya_gn1 Loves-to-Learn in Getting Data In 12-23-2022 0 0	0	0
Are any default apps in universal forwarder unnecessary? I just installed universal forwarder, And was deploying my first app using DS, I came accros few apps in place prior ... by hectorvp Communicator in Getting Data In 12-22-2022 0 5	0	5
Extreme Latency with Windows Events on one Windows Event Collector. How do I troubleshoot? Hello i have two windows event collectors. 3 domain controllers send their events to one event collector (WEC01), and... by davidwaugh Path Finder in Getting Data In 12-22-2022 2 25	2	25
When monitoring CSV file on Windows, it only ingests top line and inconsistent events? We have a distributed splunk (8.x) environment on-prem, with CM and 3 peers, 2 SH, 1 deployment server, and many clie... by calvinmcelroy Path Finder in Getting Data In 12-22-2022 0 3	0	3
Where and how do I configure a sourcetype for generic xml? Hey there! I'm trying to monitor(batch)) a folder congaing xml files, the XML files don't necessarily have the same... by dorbi Explorer in Getting Data In 12-22-2022 0 5	0	5
What is the recommended method to ingest exported sysmon logs? Context: I have an external client that uses Arctic Wolf for sysmon logs on their endpoints and need to ingest those ... by russell120k Engager in Getting Data In 12-22-2022 0 2	0	2
How to resolve ERROR PersistentScript? Disponemos de Splunk Cloud Victoria 9.0.2208.4 y hemos instalado y configurado: - Seguridad en la nube de Cisco - Co... by gsiuv Loves-to-Learn Lots in Getting Data In 12-22-2022 0 7	0	7
Need help in integrating Amazon Eventbridge with Splunk through api Hi guys, We need to get events generated from aws eventbridge to get into splunk. So we tried integrating the eventb... by Pavan0604 Loves-to-Learn in Getting Data In 12-22-2022 0 0	0	0
AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability? We have a new Splunk Cloud environment We are using AWS TA Add On to ingest files from S3 The files have extension of... by ehudb Contributor in Getting Data In 12-21-2022 0 1	0	1
How to create after hour report? I am trying to create an after hour query with specific time frames 1. Mon 0000-0700 and 1900-2400, 2. Tue 0000-0700 ... by Johnsonbc Explorer in Getting Data In 12-21-2022 0 5	0	5
Splunk HF - Typing Queue full but CPU of the machine is low Hello Splunkers,I am currently having parsing problems with my Splunk Heavy Forwarder.I know I have heavy regex that... by GaetanVP Contributor in Getting Data In 12-21-2022 0 1	0	1
How to convert the data from JSON format to raw logs? Hi , After onboarding trendmicro XDR we are facing few issue. 1. Getting logs in JSON format 2. Data is not pursed.... by debjit_k Path Finder in Getting Data In 12-20-2022 0 5	0	5
JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? Hi all, I use following simple props.conf to some json type events: [my:sourcetype]category = StructuredDATETIME_CONF... by stwong Communicator in Getting Data In 12-20-2022 0 3	0	3
How to make changes so that all logs should be indexed in a proper format? I am getting logs in Splunk. But the logs are in improper format. So I want to make changes so that all my logs shoul... by alex4 Loves-to-Learn Lots in Getting Data In 12-20-2022 0 2	0	2
Why am I unable to see springboot application logs in splunk? Hi All, I have integrated Splunk HEC with springboot .when i hit application and checked in splunk am unable to see... by sindhuja Loves-to-Learn Lots in Getting Data In 12-20-2022 0 0	0	0
Can someone provide a work example for Splunk HEC using Java Spring Boot? Can someone assist with providing a working example on how to use and send data to Splunk HTTP Event Collect (HEC) fr... by aa70627 Communicator in Getting Data In 12-20-2022 1 5	1	5
What is the reason for an incomplete data HTTP event collector? Hello dear community Could you please tell me how to find the reason. I am using HTTP Event Collector for Kubernetes.... by igor04653 Loves-to-Learn Everything in Getting Data In 12-20-2022 0 1	0	1