Getting Data In

Getting Data In
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Community Activity
hulahoop

How often does Splunk check to apply retention policy?

If a size- or time-based retention policy is set via maxTotalDataSizeMB or frozenTimePeriodInSecs in indexes.conf, ho...
by hulahoop Splunk Employee Splunk Employee in Getting Data In 03-18-2010
3 2
3
2
SteveS

Automating troubleticket creation

How can I set up Splunk to automatically open troubletickets?
by SteveS Splunk Employee Splunk Employee in Getting Data In 03-15-2010
1 1
1
1
elusive

I've installed Splunk on windows, and I see splunk-wmi.exe and splunk-regmon.exe programs. What are these? Can I turn them off?

Installed Splunk on Windows machine and in the task manager I see these two processes running by default. How can I ...
by elusive Splunk Employee Splunk Employee in Getting Data In 03-13-2010
2 2
2
2
chris

How can I find out what events get sent to the nullQueue when I try to filter events on a forwarder?

Hi I am trying to filter events on a LightWeightForwarder, but they don't get dropped. Is there a way to debug this?...
by chris Motivator in Getting Data In 03-12-2010
1 4
1
4
hulahoop

Can Splunk decode data at index time?

If I have a field value that is URL encoded then base-64 encoded, is it possible to have Splunk decode this field bef...
by hulahoop Splunk Employee Splunk Employee in Getting Data In 03-10-2010
3 7
3
7
Mick

What is the difference between a lightforwarder and a regular forwarder?

Apart from the fact that a lightforwarder does not have a web UI, what are the main differences between the 2 apps?
by Mick Splunk Employee Splunk Employee in Getting Data In 03-09-2010
0 2
0
2
chris

Data from forwarder arrives at the indexer but does not get indexed

Hi I have set up a light weight forwarder that appears to be getting data to the indexer. But I can't search for an...
by chris Motivator in Getting Data In 03-05-2010
2 2
2
2
Alan_Bradley

Can I replicate a subset of the data to a non-Splunk destination?

I need to do the following on my forwarder: Forward all data received and gathered by the forwarder to Splunk indexe...
by Alan_Bradley Path Finder in Getting Data In 02-23-2010
1 1
1
1
Justin_Grant

retrying a scripted input after a failure

[I heard this question on an internal mailing list, but it seemed generally relevant so asking it here too] I have a...
by Justin_Grant Contributor in Getting Data In 02-22-2010
1 2
1
2
hulahoop

Is it possible to tell LINE_BREAKER to stop eating my angle bracket?

The use of LINE_BREAKER is a bit cryptic to me... ok, a lot. But I think I've managed to figure out how to break my ...
by hulahoop Splunk Employee Splunk Employee in Getting Data In 02-10-2010
0 6
0
6
hulahoop

How do I group lines into a single event at index-time?

What I'm trying to do: at index time, create a multiline event based on a unique ID. In the data sample below, I nee...
by hulahoop Splunk Employee Splunk Employee in Getting Data In 02-08-2010
2 6
2
6
Yancy

What are the default sourcetypes and how are they determined?

Sometimes Splunk sets the sourcetype on an incoming file as breakable_text or too_small. What determines these sourc...
by Yancy Path Finder in Getting Data In 01-29-2010
1 1
1
1
Justin_Grant

monitoring hundreds of metrics and/or configuration items: how to do efficiently?

I'm trying to use Splunk to monitor both runtime metrics and configuration state of a server application like JBoss o...
by Justin_Grant Contributor in Getting Data In 01-27-2010
2 4
2
4
Ledio_Ago

Can I monitor Windows Registry with Splunk?

Are there ways in Splunk to monitor and index any activity on Windows Registry?
by Ledio_Ago Splunk Employee Splunk Employee in Getting Data In 01-20-2010
2 1
2
1
jrodman

How can I monitor a directory full of mixed types of logfiles while explicitly applying sourcetypes?

I have a directory /logdir and it contains various types of files, such as apache logs, syslog files, local applicati...
by jrodman Splunk Employee Splunk Employee in Getting Data In 01-15-2010
2 1
2
1
matt

How do I set a hostname?

What do I need to do to set the correct hostname for an event?
by matt Splunk Employee Splunk Employee in Getting Data In 01-15-2010
2 3
2
3
jrodman

My coldtofrozen script seems to hang splunk, what can I do?

When my selected coldToFrozenScript runs, which can take 10 minutes, the splunk search interface stops working until ...
by jrodman Splunk Employee Splunk Employee in Getting Data In 01-15-2010
0 1
0
1
cfrln

I can't see data I know is indexed

I have data indexed but the "all indexed data" dashboard module is empty. Searching for * over all time produces no r...
by cfrln Explorer in Getting Data In 01-14-2010
2 2
2
2
Top Labels
Get Updates on the Splunk Community!

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...