Getting Data In

Community Activity

Data ingest Monitor set to pull in a watched log that has no props/transforms configs applied. This would ingest the entire file ... by splunkville Observer in Getting Data In 08-11-2025 0 4	0	4
Why is Splunk Universal Forwarder unable to interpret checkpoint files for ausearch when running it as a Scripted Input? I’m running Splunk in a Linux Red Hat environment and trying to collect logs generated by the auditd service. I coul... by miketbrand0 Explorer in Getting Data In 08-08-2025 0 8	0	8
splunk how to get splunk add-on for unix and linux 9.2.0 version splunk how to get splunk add-on for unix and linux 9.2.0 version and 6.0.2 version..?? by silverKi Path Finder in Getting Data In 08-07-2025 0 2	0	2
How to edit my props and transforms to route data to an index based on index field name ? Hi allI'm building a distributed Splunk architecture with:1 Search Head2 Indexers (not in a cluster)1 Heavy Forwarder... by Sot_Sochetra Explorer in Getting Data In 08-07-2025 0 8	0	8
Is it possible to do search time field extraction based punct I have events in a log file and they have different formats from event to event. I'm wondering if there is any way to... by fredclown Builder in Getting Data In 08-07-2025 0 4	0	4
Has anyone experienced this squid error with splunk_recommended_squid log format? i am running Squid 5.2 and having an issue adding the splunk_recommended_squid log format to my squid configuration. ... by rsd0991 Engager in Getting Data In 08-05-2025 0 3	0	3
Extract public and private IP addresses fields separately I have trouble with getting public and private IP addresses fields separately. How can I extract private and public I... by cs308 Loves-to-Learn in Getting Data In 08-02-2025 0 3	0	3
information certifications ISO 27001 Team, do you know where I can find information about certifications like ISO 27001 that apply to our agents as Hotel ... by daniela1 Loves-to-Learn Lots in Getting Data In 08-01-2025 0 3	0	3
KVStore Failed 9.4.3 Hi,I upgraded Splunk Enterprise from 9.2.3 to 9.4.3, and the KVSotre status is failed.It was migrated successfully to... by tech_g706 Path Finder in Getting Data In 08-01-2025 0 5	0	5
SC4S parser Hello, I need to send all syslog data from opnsense to a specific index. As this is not a known vender source what is... by L_Petch Path Finder in Getting Data In 07-31-2025 0 2	0	2
Can't find "local event logs" option in splunk Hey, I installed splunk enterprise free trial on ubuntu server and this is the first time I am using splunk so I am f... by obuobu Engager in Getting Data In 07-30-2025 1 4	1	4
Splunk access to RHEL audit.log Running Splunk 9.3.5 on RHEL 8. STIG hardened environment. The non-Splunk RHEL instances running a Universal Forward... by ewok Explorer in Getting Data In 07-30-2025 0 4	0	4
Using Splunk UF to send data to ELK Hi, as the question suggest, I am trying to send 2 streams of logs.From the document Forward data to third-party syst... by Na_Kang_Lim Path Finder in Getting Data In 07-30-2025 0 1	0	1
Index time field extraction problem with space Hi all,I want to extract fields from a custom log format. Here's my transforms.conf:REGEX = ^\w+\s+\d+\s+\d+:\d+:\d+\... by sigma Path Finder in Getting Data In 07-29-2025 0 2	0	2
Splunk add on AWS connection pool is full HelloI'm collecting cloudtrail logs by installing Splunk add on AWS in the Splunk heavy forwarder.The following logs ... by KwonTaeHoon Path Finder in Getting Data In 07-28-2025 0 1	0	1
Issue with Searching by Sourcetypes in Splunk Hi all,I'm collecting iLO logs in Splunk and have set up configurations on a Heavy Forwarder (HF). Logs are correctly... by sigma Path Finder in Getting Data In 07-28-2025 0 5	0	5
s3 - Multiple directories data to be ingested into Splunk Cloud Hi Community,I'm exploring ways to ingest data into Splunk Cloud from a Amazon s3 Bucket which has multiple directori... by shoaibalimir Path Finder in Getting Data In 07-28-2025 0 2	0	2
Windows Security some EventIDs not showing in Splunk Hi All I've been tasked with setting up logging for Windows Certification Services and getting this into Splunk.Have ... by n_hoh Observer in Getting Data In 07-28-2025 0 6	0	6
Indexer stops sending back ACK Hi.During the day, some on my Indexers completely stops sending back the ACK, so many agents keep data in queue until... by verbal_666 Builder in Getting Data In 07-26-2025 0 6	0	6
Recent logs are not available in splunk even if recent internal logs are missing. How to fix the issue? I onboarded one production logs to splunk but after restarting the UF I am not able to see the recent logs also I am ... by isahu Observer in Getting Data In 07-26-2025 0 3	0	3
Some Windows UF not sending Security logs I’ve inherited a fleet of about 150 Windows Servers, all configured identically — same Deployment Server, TAs, inputs... by samalchow Observer in Getting Data In 07-25-2025 0 6	0	6
Splunk HEC receive data from Logstash http output Hi,Does anyone have a good example from Logstash to Splunk HEC?I only get "services/collector/raw" working with logst... by jbanAtSplunk Communicator in Getting Data In 07-24-2025 0 18	0	18
How to Optimize Search Performance for Large-Scale Data in Splunk? Hi Splunk Community,I'm new to Splunk and working on a deployment where we index large volumes of data (approximately... by zaks191 New Member in Getting Data In 07-24-2025 0 5	0	5
Exchange Message Tracking Hi,Could you help me retrieve message-tracking logs from our on-premises Exchange server? I added the following lines... by nopera Explorer in Getting Data In 07-22-2025 0 11	0	11
Excluding events from Juniper SRX logs Hi all,I'm having some issues excluding events from our Juniper SRX logs. These events are ingested directly on our W... by dsgoody Engager in Getting Data In 07-22-2025 0 2	0	2