Getting Data In

Community Activity

How to exclude a list of values for a field? Is there a shorthand for: host=SOMEENV* Type=Error NOT EventCode=1234 NOT EventCode=2345 NOT EventCode=3456 NOT Eve... by jundai Explorer in Getting Data In 09-09-2020 5 21	5	21
List/count no of all file my forwarder is monitoring HiI have an environment that is increasing in files each day, this I think is causing high CPU on the forwarders as t... by robertlynch2020 Influencer in Getting Data In 09-09-2020 0 1	0	1
Onboardering Data from Syslog-ng server Hello,I recently started with a company that has a syslog-ng server saving logs to /mnt/syslog/$year/$month/<filename... by jorob Explorer in Getting Data In 09-09-2020 0 6	0	6
time field search in load job not working Hi,I have a savedsearch which i am calling like below. \| loadjob savedsearch="admin:Splunk_Security:chk_coding_pie_ac... by surekhasplunk Communicator in Getting Data In 09-09-2020 0 3	0	3
update default.meta stanzas using REST API Hi All, How to update default.meta stanzas using REST API. Thanks in Advance. by ganesh_crms New Member in Getting Data In 09-08-2020 0 8	0	8
Global setting missing in Splunk Cloud HTTP event collector? Hi, I'm setting up an integration test between a third-party app and Splunk Cloud trail using an HTTP event collector... by mikeaston Engager in Getting Data In 09-08-2020 1 3	1	3
[AWS Trumpet] Only partial CloudTrail logs compared to the AWS Add-on? I am using the https://github.com/splunk/splunk-aws-project-trumpet to get AWS logs in, I am facing an issue though w... by wendelclark New Member in Getting Data In 09-08-2020 0 0	0	0
Is there a way to grant access to a specific index within an app's authorize.conf? I have index1, index2, and index 3. I want role_user to have access to all three within a specific app. Is there a wa... by cee137 Explorer in Getting Data In 09-08-2020 0 2	0	2
FortiGate logs forwarded from FortiAnalyzer not extracting timestamp After upgrading FortiAnalyzer (FAZ) to 6.2.3, I'm seeing Splunk timestamping issues from the FortiGate (FGT) logs it ... by ejwade Contributor in Getting Data In 09-08-2020 0 1	0	1
I am moving form 1 machine to 5 machine on Splunk and i want to know what is the best way to use them? HiWe are upgrading from 1 standalone machine to 5 machines. I am looking to get a cluster up and running.Originally w... by robertlynch2020 Influencer in Getting Data In 09-08-2020 0 3	0	3
Issue with INDEXED_EXTRACTIONS for Microsoft Exchange Server Message Tracking log files Hello, everybody! I have Splunk Enterprise 7.3.2 infrastructure with Splunk UF's deployed particularly to our corpor... by oshirnin Path Finder in Getting Data In 09-08-2020 0 3	0	3
Splunk add on for Citrix Netscaler Do I need dedicated syslog server to get syslog messages and then forward it using Universal Forwarder??Considering I... by hectorvp Communicator in Getting Data In 09-07-2020 0 2	0	2
How to pre-process input to macro before searching in base search? We have a wonderful set of end-users who can enter dates in various formats.Data sample is like reportName="finance" ... by koshyk Super Champion in Getting Data In 09-07-2020 0 1	0	1
Splunk HTTP Event Collector works only on localhost. I have set up a Splunk Enterprise trial instance on a red-hat Linux server. I enabled and setup the HEC, however when... by syedimranstonex Explorer in Getting Data In 09-07-2020 0 11	0	11
_internal large amounts of data incoming i have an average of 100 events coming into the splunk _internal index per minute on a instance that is not very busy... by zubairaizatron Explorer in Getting Data In 09-07-2020 0 2	0	2
Windows_TA vs Windows I have two apps installed on Windows clients. One looks like the full blown Windows_TA app and one looks like a trun... by cachexploit Explorer in Getting Data In 09-06-2020 0 1	0	1
How to send data (JSON/CSV) from AWS s3 to Splunk at 5 minute intervals? Hello, I am storing data (JSON/CSV) in s3 bucket in AWS and I want to send this data into Splunk and data is updated ... by rsilwal7 Loves-to-Learn Lots in Getting Data In 09-06-2020 0 2	0	2
servers time validation good morningIs there a way to validate the time of the current splunk servers? Let me explain, during these days ther... by efaundez Path Finder in Getting Data In 09-04-2020 0 1	0	1
How to collect Azure container log to splunk? Hi, I need to collect Azure container log into splunk. I will utilize azure monitor app for splunk. It is pulling log... by brandy81 Path Finder in Getting Data In 09-04-2020 0 0	0	0
How to reconfigure syslog-ng when file is getting updated but data isn't getting into indexer (Universal Forwarder)? Hi, We have configured syslog-ng to send data to indexers, Sometimes, the syslog file is getting updated but data is ... by martinnepolean Explorer in Getting Data In 09-04-2020 0 3	0	3
Windows Event Logs & Sysmon What's everyone doing for collecting both Windows Event Logs & Sysmon?Are you collecting all Even IDs or only a small... by wgawhh5hbnht Communicator in Getting Data In 09-04-2020 0 1	0	1
Change Splunk management port for single Linux host Hello!I'm new to Splunk, and I would like to change the management port for only a single host from 8089 to 9089 due ... by 3amer92 Explorer in Getting Data In 09-03-2020 0 6	0	6
Is "RecordNumber" a unique identifier? I'm dealing with a lot of duplicate event logs at the exact same millisecond. From what I can tell, everytime this ha... by michaeler Communicator in Getting Data In 09-03-2020 0 1	0	1
script input running "splunk cmd openssl" Hello,I have a script to index enddate from certificats #!/bin/sh echo debug enddate date=`date "+%d/%m/%Y %H:%M:%S"... by ktn01 Path Finder in Getting Data In 09-03-2020 0 0	0	0
App local files updated in indexer cluster I have an app which included a custom command which in turn has to cache some information on the indexer it runs. Wha... by FritzWittwer Path Finder in Getting Data In 09-03-2020 0 1	0	1