Getting Data In

Discussions

Thread Info

Splunk as Datasource for Grafana?

Hello, I'd like to import data from Splunk into Grafana so I can use Grafana's visualization and Splunk as a data...

by Explorer in

REST GET request to get list of AD users

Hello, I'm trying the following request in Postman to send a request to get the list of Active Directory users: http:...

by New Member in

csv headers are not getting listed

Hello, I have clonned the CSV source type in Splunk and created a new CSV sourcetype as Alpha_csv and configured ...

by New Member in

could not use strptime to parse timestamp

Feb 18 18:36:20 smtp2 sm-mta[17872]: l1J0a3fO017872: discarded I have one sample event. when I this it gives me "...

by Path Finder in

change date of import data

hi i'm copy log of my application to splunk server with script (i don't use forwarder here) now problem is log se...

by Motivator in

How does splunk reassamble chunks of data coming from UFs in an indexer cluster ?

By default, UFs are sending chunks of 64kB data and spread these over multiple indexers. But indexers are supposed to...

by Contributor in

How can I get more than 10,000 lines into a single event?

I want more than 10,000 lines to merge and show in a single event. [tally_nightly_prd] SHOULD_LINEMERGE=true NO_BI...

by Path Finder in

Rex pattern to extract unc path from xml

I like to extract the UNC path from a log, below a portion from the file : ;<soa:FileSystem identifier="8ec65285-1...

by Engager in

Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

I have two indexers in peer that share 1 index, and 1 data model. Both indexers are configured identically. Both data...

by Communicator in

how to force all data to go to a different index?

How do I force all data to go to a different index without inserting index=foo for all input stanzas?

by Splunk Employee in

500 Internal Server Error out of splunklib/binding.py

I'm seeing this error message stream when the TA-ObserveIT tries to get what I think is the configuration information...

by Contributor in

Why am I getting "404 Not Found" for every REST API call?

I am using the following query as per documentation: curl -k -u username:password http://myhosthere:8000/services/...

by Explorer in

KV_MODE not extracting xml fields

I have an app on a deployment server that runs a script and has splunk ingest the output which is valid xml. I've add...

by Explorer in

Getting containerized universal forwarder to forward host log files

I would like to be able to run the forwarder in a container, and have it forward my host logs from /var/log. So I mou...

by New Member in

Splunk indexed data into Azure datalake storage or Blob storage

Is there any way to send already indexed splunk data (from one index) into Azure data lake storage or Azure Blob stor...

by Explorer in

Change index depending on host

Hi all, I'm trying to split Windows events into different indexes at index time depending on the host which is sen...

by Path Finder in

Looping in csv items to count how many values matches in a index

Hi all, starting from a csv which contains 10 items, I want to count ( in order to produce a chart ) all the matches ...

by Path Finder in

in the multiselect input how to give user option to choose AND or OR

Hi, I have dynamic users in the input type which i am populating in multiselect Now i want to give the user the optio...

by Communicator in

file monitor input only ingest last 200 bytes of the file

Hi guys, I need to on-board some log files, but only the last 200 bytes of each log files contain useful informati...

by Contributor in

How to check how long splunk uf agents are down on particular servers?

Hi , We had list of servers a,b,c,d,e,f. How can we check how long splunk uf agents are down on the servers a,b,c,...

by Communicator in

Monitoring Console - Deployment-Wide Averaged System Load Average

How would we interpret the "Deployment-Wide Averaged System Load Average" Monitoring console indexing metrics? When w...

by Path Finder in

How to index an XML file with unix time format

I have XML files in my PC that I want to index them in Splunk, I need the inputs and the props.conf changed. I did ev...

by New Member in

Unable to filter specific events with props.conf & transforms.conf

I've been reading into how to filter incoming events between the Parsing and Indexing stages of our data pipeline and...

by Engager in

Source type for dmesg log file

I was wondering if anyone had a good solution for a proper source type for dmesg? Or failing that some way of handlin...

by Path Finder in

How to monitor user activity (logon and logoff)

Hello, Excuse my lack of expertise with Splunk. Could you please let me know how i can track when a specific user ...

by New Member in

Get Updates on the Splunk Community!

Getting Data In

Discussions

Splunk as Datasource for Grafana?

REST GET request to get list of AD users

csv headers are not getting listed

could not use strptime to parse timestamp

change date of import data

How does splunk reassamble chunks of data coming from UFs in an indexer cluster ?

How can I get more than 10,000 lines into a single event?

Rex pattern to extract unc path from xml

Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

how to force all data to go to a different index?

500 Internal Server Error out of splunklib/binding.py

Why am I getting "404 Not Found" for every REST API call?

KV_MODE not extracting xml fields

Getting containerized universal forwarder to forward host log files

Splunk indexed data into Azure datalake storage or Blob storage

Change index depending on host

Looping in csv items to count how many values matches in a index

in the multiselect input how to give user option to choose AND or OR

file monitor input only ingest last 200 bytes of the file

How to check how long splunk uf agents are down on particular servers?

Monitoring Console - Deployment-Wide Averaged System Load Average

How to index an XML file with unix time format

Unable to filter specific events with props.conf & transforms.conf

Source type for dmesg log file

How to monitor user activity (logon and logoff)

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Observability protocols to know about

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

GlobalMantics Dataset Query

WARN SSLCommon [53742 FwdDataReceiverThread] - Re...

What is the correct format for including the API k...

Service Principal configuration for Splunk Add-on ...

AWS VPC Flow logs getting ingested non-human reada...