Getting Data In

Community Activity

How to extract Message field from a new WinEventLog source? Hi, Splunk is unable to parse the Message field for a new WinEventLog source. These are AD changes(Recorded by Chang... by att35 Builder in Getting Data In 05-20-2020 0 6	0	6
Monitoring unique log files What is the best way to monitor log files that are unique to a host? For example, if hosta has log.x, and hostb has ... by user789 New Member in Getting Data In 05-20-2020 0 2	0	2
How to stop Splunk forwarder from re-indexing files when I edit them with vi? Splunk forwarder is re-indexing files when I edit them with vi. Has anybody seen this before? I have used the below ... by bhupalbobbadi Path Finder in Getting Data In 05-20-2020 0 2	0	2
can i install heavy forwarder on my windows server ? to integrate my mcafee with splunk ,sould i need to install heavy forward on my windows server by itishree123 New Member in Getting Data In 05-20-2020 0 2	0	2
SNMP polling error Have problem with snmp polling. I have 140 servers, which cpu i must monitor, and use snmp polling for it. But from 1... by askhat_pernebek Path Finder in Getting Data In 05-20-2020 0 0	0	0
How to forwarded logs from Splunk to MCAS Hi What will be the best way to implement the below request ? We need to configure the some logs to be forwarded fr... by rayar Contributor in Getting Data In 05-19-2020 0 8	0	8
Universal Forwarder not reading user-seed.conf (version 7.2.6). I have read other articles but haven't found an answer. I recently pushed the universal forwarder to Windows client... by plymalebl Explorer in Getting Data In 05-19-2020 0 1	0	1
Can I configure the output.conf file via app deployment to enable encryption of traffic from universal forwarders to indexer? I am trying to enable encryption of the traffic from all of my universal forwarders to the indexer. Looks like this i... by snix Communicator in Getting Data In 05-19-2020 0 0	0	0
Conditional execution of transforms based on property of event Does anyone know of a way to control execution of transforms based on a non-metadata property of an event? I have ... by dstaulcu Builder in Getting Data In 05-19-2020 1 1	1	1
Clone Splunk Indexer? Hey All, Off the wall question and was curious if anyone has tried this or not and if its advisable. Looking to add... by adalbor Builder in Getting Data In 05-19-2020 0 6	0	6
How to index data from a single server when the log path is in a shared drive? Hi All, I am facing the below issue: I am reading few log sources (monitor) from the 3 servers, Server1, Server2 and... by santosh_hb Explorer in Getting Data In 05-19-2020 0 3	0	3
Different sourcetype with one hostname We have a series of logs from different devices such as (Firewall .waf. antivirus,...) that come from syslog server t... by khanlarloo Explorer in Getting Data In 05-19-2020 0 9	0	9
Debug HEC input How debug HEC input? To see incoming JSON? by vadimm New Member in Getting Data In 05-18-2020 0 6	0	6
TIMESTAMP_PREFIX not finding timestamp in JSON structure. I need some help getting me config right in pros.conf. When the data comes I can see the _time is not set to the val... by stirlec Explorer in Getting Data In 05-18-2020 0 7	0	7
What is included in HEC introspection data? I'm ingesting data via HEC and I know there is data about it in _introspection, but I don't know what I'm looking at ... by davidpaper Contributor in Getting Data In 05-18-2020 0 3	0	3
Issue with indexer recreating apps after manual deletion (400 Error) Splunk Enterprise v8.03, Ubuntu 18.04. I have a couple of apps that I am trying to update on my Indexer (TA's) and am constantly seeing a 400 bad request er... by jkujawa Explorer in Getting Data In 05-18-2020 0 2	0	2
Indexer Splunkd services are not able to run In indexer cluster environment one of the Indexer got stopped unable to start/restart C:\Windows\system32>d: D:>cd sp... by phanichintha Path Finder in Getting Data In 05-18-2020 0 11	0	11
.bash_history I have multisite environment and I want to monitor all the ssh user commands through .bash_history. for that purpose ... by raiqbal47010 New Member in Getting Data In 05-18-2020 0 2	0	2
Result of the report using rest api Hi, How can i fetch result of an existing report in Splunk (report already executed) using a rest API. The report ge... by santosh_bwn New Member in Getting Data In 05-18-2020 0 1	0	1
Filtering NULL values after STATS Hello Splunkers, First of all, than you all for such great community. I have a question. I am running a query in wh... by gmartinv New Member in Getting Data In 05-17-2020 0 2	0	2
Metrics Button Share All, After installing the Anlaytics Workspace app I would like the metrics button to appear in one of my custom app... by daniel333 Builder in Getting Data In 05-17-2020 0 2	0	2
How to change time zone from EST to CET on schedule searches ? Hi all, I have found all schedule searches are running on EST instead of CET timezone, if i go and props.conf in /s... by 90509 Engager in Getting Data In 05-16-2020 0 10	0	10
Need to remove prefix from json array. Need to remove prefix from json array. I want to remove everything before {"id" {"@odata.context":"https://graph.mic... by vin02ptl Explorer in Getting Data In 05-16-2020 0 6	0	6
input for splunk Hi, I should monitor a log file in a Splunk all-in-one windows-based. This file contains a sequence of rows with a ti... by achille83 Explorer in Getting Data In 05-16-2020 0 1	0	1
How can we restrict computer owners from injecting more data into splunk? How can we restrict computer owners from injecting more data into splunk?. We have around 1000 computers which report... by ravip4146 New Member in Getting Data In 05-16-2020 0 1	0	1