Getting Data In

Community Activity

Data model tags whitelist- Should I add tags used inside constraints on my own? Hi all, I installed the Splunk CIM on my Splunk instance and I've a doubt regarding tags whitelisting. The docs says ... by tbonfa Loves-to-Learn in Getting Data In 09-14-2022 0 4	0	4
Multiple inputs files, with 1 app? Hey all, So I found a question here about using multiple inputs.conf files.. how it's possible with multiple apps but... by skeer007 Explorer in Getting Data In 09-14-2022 0 5	0	5
[udp://:portnumber] Event Blacklist- How do I prevent unwanted data from being indexed? Hello, I am currently receiving firewall data on my heavy forwarder on a specific port number. On the HF there is an ... by LinghGroove Explorer in Getting Data In 09-14-2022 0 4	0	4
What is the difference in these stanzas? What is the difference between these stanzas... [WinEventLog://Application] disabled = 0 index=tablets sourcetype=ta... by stcrispan Communicator in Getting Data In 09-14-2022 0 5	0	5
Is there a way I can change source name on HEC? I am using HEC to push the data to Splunk, and in the HEC we have a field Source, And the log which I am forwarding t... by AbhinavRanjan Loves-to-Learn Lots in Getting Data In 09-14-2022 0 0	0	0
Forwarding mirror copies of logs to multiple indexer groups [Splunk UF]- Why are the logs not being received properly? Hi There, I have a universal forwarder that is installed on a Syslog Server and is reading all the logs received on t... by ahmadgul21 Explorer in Getting Data In 09-13-2022 0 15	0	15
How do I clone all data received from one indexer to another indexer? Hello, I have one indexer cluster that receives data over inputs.conf [splunktcp://9997]. I want to clone all data re... by andrew207 Path Finder in Getting Data In 09-13-2022 0 3	0	3
Which inbound/outbound ports should be opened to send data to HTTP Event Collector? Hello, I understand that the HTTP Event Collector receives data over HTTPS on TCP port 8088 by default. What i am won... by mark-jones Explorer in Getting Data In 09-13-2022 0 3	0	3
[Solution] Splunk HEC and iOS/HomeKit Shortcuts Splunk HEC and iOS/HomeKit Shortcuts A number of years ago the PM for HEC happen to sit behind me at a conf keynote. ... by starcher Influencer in Getting Data In 09-13-2022 3 0	3	0
Why are there strange characters in sourcetype? Our Splunk environment is producing many Windows eventlog entries with broken sourcetypes. When looking at the source... by sternbernard Explorer in Getting Data In 09-13-2022 0 3	0	3
Why can't I get Salesforce ListViewEvent data? Hi , I have been trying to get data from ListViewEvent form salesforce through "Inputs" in "Splunk Add on for Salesfo... by Clint New Member in Getting Data In 09-13-2022 0 1	0	1
How to compare events "without" common fields? Hello All,I'm trying since 3 days now to find a solution for my problem but without success.I look around for solutio... by mkouzou Explorer in Getting Data In 09-13-2022 0 12	0	12
Log Pipeline Management - how to convert comma decimal to dot? Hi, May i know how to convert raw data (cookedvalue) from comma to dot using regex? Raw Data in Log Observer "instan... by fongpen Path Finder in Getting Data In 09-13-2022 0 2	0	2
Why did splunk fail to install uf on windows2012 r2? my os is windows2012 R2, I try to install splunk uf 9.0.0.1.first, I uninstall old splunk UF 7.0.2 from "uninstall pr... by ssu New Member in Getting Data In 09-13-2022 0 0	0	0
Data is not being registered by Universal Forwarder- Which part should I check? Data cannot be registered by Universal Forwarder. There are a total of 12 Universal Forwarders. Only one of these uni... by hhhwang Explorer in Getting Data In 09-12-2022 0 3	0	3
Why is WILDCARD in lookup not working? I am using splunk cloud.I would like to use the lookup file to find out if there is an IP corresponding to the blackl... by Toki Explorer in Getting Data In 09-12-2022 0 2	0	2
Script for finding frozen data by date range and restore them This is a script for finding frozen bucket files in time range you gave It shows folders + size + start time and endt... by Mehran_Safari Explorer in Getting Data In 09-12-2022 0 0	0	0
Solution for: How to find and delete OLD Frozen data by older than X days this bash script will search frozen path you give + oldest needed time then will show older logs and asks you to remo... by Mehran_Safari Explorer in Getting Data In 09-12-2022 1 0	1	0
Opinion on frozen data deletion script that deletes older than 12 months data Hello guys, I've created a shell script, scheduled with cron-like software, which deletes 12+ months data except for ... by splunkreal Influencer in Getting Data In 09-12-2022 2 9	2	9
Can we delete frozen data in Splunk? Recently we encountered a problem. /opt file system on the indexer server has reached 100% due to which users were un... by pratapa Explorer in Getting Data In 09-12-2022 0 4	0	4
Is there any guidance on finding the proper frozen bucket I would need for a specific time frame? Is there any guidance on finding the proper frozen bucket I would need for a specific time frame? by seankoniarz Explorer in Getting Data In 09-12-2022 0 3	0	3
Cluster indexes.conf -> inputs.conf -> App -> serverClass confusion I am creating an index - configured the inputs.conf file. I have two prod servers with app logs that have the same Li... by jcorcoran508 Path Finder in Getting Data In 09-11-2022 0 1	0	1
Is it possible to get the data via HEC from a source to two different Splunk instances? Hi Everyone, I need to know if is it possible to get the data via HEC from a source to two different Splunk instances... by Splunk4 Explorer in Getting Data In 09-11-2022 0 0	0	0
Is there a way to track when an index stopped bring in data? Is there a way to track when an index stopped bring in data? I just noticed that one of our indexes is no longer brin... by kruane Explorer in Getting Data In 09-10-2022 0 1	0	1
How can I immediately verify my changes have put these host's new events in the correct TZ? I have a number of hosts sending logs "in the future". I've configured my indexer's props.conf to adjust the TZ for t... by woodams Explorer in Getting Data In 09-09-2022 0 1	0	1