Getting Data In

Community Activity

	Filter splunk data to reduce ingestion size We are transferring log using log drains and using token created using HTTP event collector. We need to filter data ... by splunk2xconnect Observer in Getting Data In 12-20-2021 0 2	0	2
	Role of Heavy Forwarder between UF and Indexer Hi,Indexer can do Parsing and Indexing then why do we use HF between UF and Indexer? by VijaySrrie Builder in Getting Data In 12-18-2021 0 4	0	4
	Intermediate Forwarder in Splunk cloud Hi,Why do we use IF in Splunk cloud.I know HF can work as IF, then why don't we call it as HF itself??What will happe... by VijaySrrie Builder in Getting Data In 12-18-2021 0 1	0	1
	Props.conf not picking up linemerge Lines in my sourcetype are not being picked up correctly at all. Each event is being split into dozens of lines. Al... by markhvesta Path Finder in Getting Data In 12-18-2021 0 6	0	6
	How to reset Splunk UF to re-monitor a single directory, not all directories? Hi -I have a Splunk UF monitoring many directories on a rsyslog (receiver) server.One of the directories populated wi... by Glasses Builder in Getting Data In 12-17-2021 0 1	0	1
	What happens when an index configuration accidentally gets deleted? Hi, I didn't find a detailed description of what happens when an index configuration has been deleted. So far, I fo... by ikulcsar Communicator in Getting Data In 12-16-2021 0 5	0	5
	SQS Based Input from S3: Assign different sourcetype based on filename Hello,I have a Heavy Forwarder on which I receive logs via Splunk for AWS addon as they appear in my S3 bucket.I know... by LegalPrime Path Finder in Getting Data In 12-16-2021 0 2	0	2
	Universal Forwarder - wineventlog Using the Splunk Universal Forwarder for windows. Does the forwarder identify the data as wineventlog? How is that ... by jwilliams Explorer in Getting Data In 12-16-2021 0 1	0	1
	Configure Splunk Universal Forwarder with TCP input to send data with HTTP output to HEC filtering internal logs Hello,Due to a specific requirement we have to install a Splunk Universal Forwarder acting as "intermediate forwarder... by edoardo_vicendo Builder in Getting Data In 12-16-2021 0 7	0	7
	Microsoft 365 Defender add-on for splunk Hi,This add-on is to ingest MCAS logs into splunk?Or do we need to use syslog collectors to ingest the MCAS logs? and... by VijaySrrie Builder in Getting Data In 12-15-2021 0 1	0	1
	timestamp issues with threatconnect TA Good Afternoon, I am having an issue with the ThreatConnect TA. The API appears to be connecting as expected but n... by jerm1020rq Explorer in Getting Data In 12-15-2021 0 0	0	0
	Use a custom source type for specific Windows firewall events We use Splunk for storing and analyzing Windows security events. We now want to start storing firewall events related... by coenvandijk Observer in Getting Data In 12-15-2021 0 2	0	2
	How to avoid same log with same content ingestion in splunk from different servers Hello,I have 10 servers for same purpose. If one server is down others will be active so that no loss of business con... by narmadak Engager in Getting Data In 12-15-2021 0 3	0	3
	Where can I keep my props.conf having datetime.xml and SEDCMD on HF /indexer?unable to index to index the file [new]DATETIME_CONFIG=/etc/apps/Test/local/datetime.xmlSHOULD_LINEMERGE=falseBREAK_ONLY_BEFORE=\nExecution\sServerCHA... by mitali Explorer in Getting Data In 12-15-2021 0 2	0	2
	Prisma Cloud Twistlock App not working Hello Fellow Splunkers!I have an environment that's using Twistlock and is deployed in EKS. We are able to collect th... by astackpole Path Finder in Getting Data In 12-15-2021 0 0	0	0
	Remove characters during search time extraction Requesting assistance with removing characters from logs during search time. Sample Data: "{"log":"{<!-- -->\"@t\""2021-12-1... by parkertctr Path Finder in Getting Data In 12-15-2021 0 0	0	0
	Azure Event Hub messages coming to Splunk as multiple events Hello,We are integrating our on-prem Splunk (version 8.2.3) to retrieve messages from an Azure Event Hub. We have con... by l3ender Engager in Getting Data In 12-15-2021 0 1	0	1
	Default datetime fields I am using Splunk to Search historical data in a virtual index but I have noticed that the default date_year is being... by Martin583 Explorer in Getting Data In 12-15-2021 0 4	0	4
	Comparing counts for different time ranges Hi , when I'm deploying new changes to my services I want to compare the last day's error logs to the last week to se... by queryaslan Explorer in Getting Data In 12-15-2021 0 6	0	6
	Dual Forwarder Configuration Hi Everyone,I am trying to figure out how can I do dual forwarder configuration for universal forwarders. Can someone... by MrWhoztheBoss Explorer in Getting Data In 12-15-2021 0 3	0	3
	Looking for a device to track home power output/data Looking for a device that can monitor power usage that is compatible with splunk. Looking to place it connected to an... by pc1 Path Finder in Getting Data In 12-14-2021 0 2	0	2
	Timeparsing issues Hello all,I'm having a time parsing issue that I don't know how to fix and am looking for some help.My inputs on the ... by walsborn Path Finder in Getting Data In 12-14-2021 0 2	0	2
	How to extract specific key/value pairs from a JSON payload and index them separately I have a JSON payload that's ingested through a REST API input on a heavy forwarder, with the following configuration... by beetlegeuse Path Finder in Getting Data In 12-14-2021 0 4	0	4
	How do you remove a header from JSON? Hi all I'm ingesting some JSON via REST API, but the events are all squashed into one large event. I'm pretty sure ... by stevenbutterwor Path Finder in Getting Data In 12-14-2021 0 4	0	4
	How do I find root causes of searches being delayed in the ES across the board? Thank u a million I have a few error messages in my ES about searches being delayed. How do I find the root causes. If multiple delays ... by SamHTexas Builder in Getting Data In 12-13-2021 0 1	0	1