Getting Data In

Community Activity

How to adjust timestamps for some sources coming from the universal forwarder? I have a certain host that sends several logs from multiple sources using the Linux Universal Forwarder. Most of thes... by bigfatyeastroll Path Finder in Getting Data In 05-22-2020 0 3	0	3
Best practices for HEC for on prem Splunk Distributed environment? Hello All, We have a splunk distributed environment with intermediate heavy forwarder tier and indexer tier. We need... by abhi04 Communicator in Getting Data In 05-22-2020 0 1	0	1
How to log to metric with unstructured data? Hello Guru, I would like to do "log to metric" on unstructured data. Let's say the data is "access_combined.log". I... by brandy81 Path Finder in Getting Data In 05-22-2020 0 5	0	5
Can I get the host name and the forwarding host name I have a long established forwarding situation where a network device writes its log files to a linux host over a net... by mikeydee77 Path Finder in Getting Data In 05-22-2020 0 5	0	5
Python 3 modular input on a universal forwarder version 8 In light to the discontinuation of Python 2.7 we have upgraded both our universal forwarders (to version  and our sy... by jthunnissen Path Finder in Getting Data In 05-22-2020 4 10	4	10
Log4J with splunk-library-javalogging-1.8.0.jar causes - Incorrect index code":7,"invalid-event-number I was previously using Splunk jar 1.7.2 which uses Apache Http client, I was able to setup log4j config to hit the sp... by obrientim New Member in Getting Data In 05-22-2020 0 2	0	2
Splunk Forwarder transmit Incomplete events for Oracle GG Logs Here is my log section. lines in bold are not being written to Splunk. They all are on different lines in Log so i e... by kvallala Explorer in Getting Data In 05-22-2020 0 15	0	15
How to send json data via HEC I am using a Python script to send data to Splunk via HEC. There's no problem when curling a simple "Hello World". Ho... by timyong80 Explorer in Getting Data In 05-21-2020 0 2	0	2
How to set Access-Control-Allow-Header for KV Store in Splunk 7.3.4 I created a web app that runs in Splunk. It is installed in $SPLUNK_HOME/etc/apps . The user can enter some data in a... by wstrellis New Member in Getting Data In 05-21-2020 0 0	0	0
How to forward all indexed data from all indexes from heavy forwarder to another instance over ssl? I am using Splunk Free, and the Splunk add-on for AWS, attempting to index and forward generic s3 data with a custom ... by ififitsisits New Member in Getting Data In 05-21-2020 0 0	0	0
How can I get a list of all hosts plus their sources from Splunk? I often get asked by app teams "how can I see all the log files that are being monitored for my app servers" (they do... by Glenn Builder in Getting Data In 05-20-2020 0 5	0	5
How do you call multiple REST APIs? Is it possible to call multiple APIs using Splunk? To be more clear, have an API that will log in to the get sessionI... by nithinrao9696 New Member in Getting Data In 05-20-2020 0 4	0	4
Time Prefix Question Hello All I have a time prefix question Here is my timestamp May 20 10:59:30 svr-orw-nac-01 2020-05-20 17:59:30,64... by edwardrose Contributor in Getting Data In 05-20-2020 0 1	0	1
How to extract Message field from a new WinEventLog source? Hi, Splunk is unable to parse the Message field for a new WinEventLog source. These are AD changes(Recorded by Chang... by att35 Builder in Getting Data In 05-20-2020 0 6	0	6
Monitoring unique log files What is the best way to monitor log files that are unique to a host? For example, if hosta has log.x, and hostb has ... by user789 New Member in Getting Data In 05-20-2020 0 2	0	2
How to stop Splunk forwarder from re-indexing files when I edit them with vi? Splunk forwarder is re-indexing files when I edit them with vi. Has anybody seen this before? I have used the below ... by bhupalbobbadi Path Finder in Getting Data In 05-20-2020 0 2	0	2
can i install heavy forwarder on my windows server ? to integrate my mcafee with splunk ,sould i need to install heavy forward on my windows server by itishree123 New Member in Getting Data In 05-20-2020 0 2	0	2
SNMP polling error Have problem with snmp polling. I have 140 servers, which cpu i must monitor, and use snmp polling for it. But from 1... by askhat_pernebek Path Finder in Getting Data In 05-20-2020 0 0	0	0
How to forwarded logs from Splunk to MCAS Hi What will be the best way to implement the below request ? We need to configure the some logs to be forwarded fr... by rayar Contributor in Getting Data In 05-19-2020 0 8	0	8
Universal Forwarder not reading user-seed.conf (version 7.2.6). I have read other articles but haven't found an answer. I recently pushed the universal forwarder to Windows client... by plymalebl Explorer in Getting Data In 05-19-2020 0 1	0	1
Can I configure the output.conf file via app deployment to enable encryption of traffic from universal forwarders to indexer? I am trying to enable encryption of the traffic from all of my universal forwarders to the indexer. Looks like this i... by snix Communicator in Getting Data In 05-19-2020 0 0	0	0
Conditional execution of transforms based on property of event Does anyone know of a way to control execution of transforms based on a non-metadata property of an event? I have ... by dstaulcu Builder in Getting Data In 05-19-2020 1 1	1	1
Clone Splunk Indexer? Hey All, Off the wall question and was curious if anyone has tried this or not and if its advisable. Looking to add... by adalbor Builder in Getting Data In 05-19-2020 0 6	0	6
How to index data from a single server when the log path is in a shared drive? Hi All, I am facing the below issue: I am reading few log sources (monitor) from the 3 servers, Server1, Server2 and... by santosh_hb Explorer in Getting Data In 05-19-2020 0 3	0	3
Different sourcetype with one hostname We have a series of logs from different devices such as (Firewall .waf. antivirus,...) that come from syslog server t... by khanlarloo Explorer in Getting Data In 05-19-2020 0 9	0	9