Getting Data In

Community Activity

Docker - Universal Forwarder service stops - Test basic https endpoint failed Hi,I am new to Splunk and running both Splunk Enterprise and Universal Forwarder in a Docker container (on the same h... by pmcl77 Loves-to-Learn Lots in Getting Data In 03-04-2025 0 9	0	9
How to Integrate Canary Honeypot with Splunk for Enhanced Security Monitoring? I’m implementing a Canary Honeypot in my company and want to integrate its data with Splunk. What key information sho... by KKuser Path Finder in Getting Data In 03-04-2025 0 1	0	1
JSON array not onbaording as expected Hello,I am having trouble onboaring json array data.I read many contributions , but i still having troublesThis is th... by harryvdtol Path Finder in Getting Data In 03-03-2025 0 3	0	3
How to integrate SentinelOne Singularity Enterprise data into Splunk Cloud? I want to integrate SentinelOne Singularity Enterprise data into my security workflows. What critical data (e.g., pro... by KKuser Path Finder in Getting Data In 03-03-2025 0 0	0	0
Integration between Confluent and Splunk We were told the following - Confluent Vendor has provided the Telemetry URL to configure in the Splunk's Open Teleme... by danielbb Motivator in Getting Data In 03-03-2025 0 1	0	1
HEC - verify what sources are using a HEC token We want to be able to monitor what sources/devices are using what HEC tokens.I know we can use _introspection to retr... by stevensk Explorer in Getting Data In 03-03-2025 0 10	0	10
Parsing issue in distributed Environment Hello Team,parsing issue I have built a distributed Splunk lab using a trial license. The lab consists of three index... by Namdev Loves-to-Learn Lots in Getting Data In 03-03-2025 0 6	0	6
flatterning BodyJson to match splunk TA for aws guardduty We have successfully ingested from an AWS SQS queue guardduty logsIts structured JSON , but the extracted records ar... by jonxilinx Path Finder in Getting Data In 03-01-2025 0 1	0	1
File growth rate must be higher than indexing or forwarding rate Hi guys,I am currently encountering an error that is affecting performance, resulting in delays with the file process... by Rakzskull Path Finder in Getting Data In 02-28-2025 0 11	0	11
Can we clone a splunk instance of Searchhead and indexer and add the new VM to the cluster Hi ,We have a cluster of 3 searchheads and 3 indexers 2+1 primary and DR setup for both indexers and searchhead. If a... by bapun18 Communicator in Getting Data In 02-28-2025 0 3	0	3
Sending JSON log via rsyslog. Hi colleagues, hope everyone is doing well! I need some advice.I have a server that writes logs to /var/log/test_log.... by gitingua Communicator in Getting Data In 02-28-2025 0 4	0	4
Can splunk ingestion pipeline drop or route older events? Is there an option to drop older events from the pipeline? Older events can cause frequent bucket rolling and most li... by hrawat Splunk Employee in Getting Data In 02-28-2025 0 2	0	2
Unable to use nullqueue properly for a Storage Account input Hi everyone,We are pulling Firewall data from a Storage Account containing several categories. There is one specific ... by att35 Builder in Getting Data In 02-27-2025 0 2	0	2
Pushing Powershell Scripts out via Universal Forwarder - Specifying specific hosts I would like to run powershell scripts and commands out to my endpoints via the Universal Forwarder, but based on the... by kjehth93 New Member in Getting Data In 02-27-2025 0 1	0	1
Why is my sourcetype configuration for JSON events with INDEXED_EXTRACTIONS making each extracted field multivalue with duplicate values? I have a Python script configured as a data input that generates one JSON object per line containing events. This is ... by asieira Path Finder in Getting Data In 02-27-2025 10 13	10	13
How to configure HTTP Event collector to log client/source IP? My team has a growing interest in looking at geo location as a function of client IP address. I've installed a plugi... by mbintz Explorer in Getting Data In 02-26-2025 2 5	2	5
Splunk-winevtlog event missing in Splunk Hi I have the following conf for Application events: [WinEventLog://Application] _TCP_ROUTING = sample current_only =... by Singh10 Explorer in Getting Data In 02-26-2025 0 1	0	1
strange timechart effect Hello I have xml messages in search. row like this <log><local_time>2025-02-25T15:02:59:955059+05:00</local_time><b... by alexeysharkov Path Finder in Getting Data In 02-26-2025 0 12	0	12
Not able to parse json with spath ,something wrong but not json Hi,I need to ingest some logs into splunk, so file&dirs data input its my choice.Also new index was created , _json a... by ekmek4 Explorer in Getting Data In 02-26-2025 0 5	0	5
Field extraction unsuccessful while index time I am trying to extract field at index time. Hence I have given following in my cluster master and pushing to indexers... by Karthikeya Communicator in Getting Data In 02-26-2025 0 12	0	12
Discard long messages? I have an errant application that is sending too much data to my Splunk Enterprise instance.This is causing licensing... by BogeyMan Loves-to-Learn Lots in Getting Data In 02-25-2025 0 2	0	2
Change index name of metrics data Hi All,I have a challenge, which i after many considerations have made a decision to, which indeed also have some con... by BTrust Path Finder in Getting Data In 02-25-2025 0 4	0	4
Is there a way to force UF to phone home to DS? Hi All, I just want to ask if there's a way to force UF to phone home to DS, we want to initiate a force phone home ... by mjlsnombrado Communicator in Getting Data In 02-25-2025 0 3	0	3
Lastchance index troubleshooting by ayomotukoya Explorer in Getting Data In 02-24-2025 0 4	0	4
How to rename indexname which is already on-boarded and data is coming. How to rename index name? We have already an index created which is receiving data. Now we want to change that index ... by Karthikeya Communicator in Getting Data In 02-24-2025 0 1	0	1