Getting Data In

Discussions

Thread Info

event line break in props

---------------------------- This is an Example (He/She) ----------------------------- Version: 21.04.812-174001 Date...

by Explorer in

Rsyslog configuration with Splunk

Please help me in configuring rsyslog to Splunk. Our rsyslog server will receive the logs from network devices and ou...

by Path Finder in

TCP-SSL on heavy forwarder (Checkpoint)

Hello, could you tell me how to properly have dedicated server certificate for specific tcp-ssl in inputs.conf (Che...

by Motivator in

How do I configure Universal Forwarder to not send INFO Metrics over TCP?

My ouputs conf looks like this: [tcpout] defaultgroup = logstash disabled = false forwardedindex.0.whitelist = .*...

by Explorer in

SentinelOne Applications Channel No Longer Populating Events

We've been collecting data with the inputs add-on ( Input Add On for SentinelOne App For Splunk) for several years...

by Explorer in

Custom datetime.xml for x12 format

Trying to get datetime.xml configured to recognize a timestamp in x12 file format with no success... Here are the ...

by Path Finder in

How to Assign Values for _time at Index Time for Future Searching?

I have a CSV file that I would like to index one time only. There are two fields (Date, Time) that I want to be able ...

by Builder in

forwarder manager stopped after upgrade from 9.1 to 9.2.0.1

Linux, RHEL 8.9. Splunk 9.2.0.1 Had a forwarder manager running (for years) with 2,00...

by Communicator in

TA-pps_ondemand Error: KV Store is disabled

In Splunk Cloud for one of my client environment, I'm seeing below message. TA-pps_ondemand Error: KV Store is disa...

by Explorer in

Data filtering location

Hello, let me explain my architecture. Multi site cluster (3 site cluster)... 2 indexers, 1 SH, 2 syslog servers ...

by Path Finder in

Script Executing Late by the UF

Hi, I have the following stanza in the inputs.conf: [script://.\bin\test_data.path] _TCP_ROUTING = test disabled = ...

by Explorer in

Getting Print Spooler Logs into Splunk

We need to get Windows Print Spooler logs into splunk but not sure where to start. The specific event codes are gener...

by New Member in

Splunk Add-on Builder: Global Account settings

Hi, Is it possible when using Global Account to customise the fields? i.e. add other fields than only Username and ...

by Path Finder in

Impact analysis of upgrade of Splunk UF agent on Cloud instance

Hi Team, Currently, we are using Splunk UF agents which is installed on all infra servers and which receives config...

by Explorer in

How can I use wildcards (*) for the source stanza in props.conf?

Hi, In my live splunk environment, I have a syslog receiver on a Linux machine putting all incoming logs in /opt/s...

by New Member in

Ingested time for csv file on windows

background - the designed windows log flow is Splunk Agent of Universal forwarder -> Splunk Heavy Forwarder-> Splun...

by Loves-to-Learn in

Issues with HTTP Status for HEC token

Hey, I am facing following issues when sending data using HEC token. Connection has been established with no issue ...

by Motivator in

Trying to get eval to push multiple values to one field

Currently trying to get eval to give multiple returns | eval mitre_category="persistence,Defense_Evasio...

by Engager in

Props and Transforms doubt

I am new to Splunk admin and please explain this following stanzas: We have a dedicated syslog server which receive...

by Path Finder in

import Adaudit logs into Splunk

I want to import Adaudit logs into Splunkbut I don't know howThe important thing is that I want to do this from the o...

by Explorer in

integrate Group-ib DRP with Splunk.

Hello members, i'm trying to integrate splunk wtih Group-ib DRP product but i'm facing issues with the applicat...

by Explorer in

WinRegMon

Can I use the following attributes in the WinRegMon Stanza in inputs.conf? I want to get a snapshot every Tuesday at ...

by Explorer in

Scripted Input Delayed Data

Hi, I have the following stanza in Inputs.conf: [script://.\bin\test_data.path] _TCP_ROUTING = test di...

by Explorer in

Network logs ingestion

Hi all, Let me explain my infrastructure here. We have a dedicated 6 syslog servers which forwards data from networ...

by Path Finder in

Need to give add data capability to user in splunk cloud

Hello All, i have a request where users will add their data(csv) manually every day. we are using splunk cloud vers...

by Motivator in

Get Updates on the Splunk Community!

Getting Data In

Discussions

event line break in props

Rsyslog configuration with Splunk

TCP-SSL on heavy forwarder (Checkpoint)

How do I configure Universal Forwarder to not send INFO Metrics over TCP?

SentinelOne Applications Channel No Longer Populating Events

Custom datetime.xml for x12 format

How to Assign Values for _time at Index Time for Future Searching?

forwarder manager stopped after upgrade from 9.1 to 9.2.0.1

TA-pps_ondemand Error: KV Store is disabled

Data filtering location

Script Executing Late by the UF

Getting Print Spooler Logs into Splunk

Splunk Add-on Builder: Global Account settings

Impact analysis of upgrade of Splunk UF agent on Cloud instance

How can I use wildcards (*) for the source stanza in props.conf?

Ingested time for csv file on windows

Issues with HTTP Status for HEC token

Trying to get eval to push multiple values to one field

Props and Transforms doubt

import Adaudit logs into Splunk

integrate Group-ib DRP with Splunk.

WinRegMon

Scripted Input Delayed Data

Network logs ingestion

Need to give add data capability to user in splunk cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Observability protocols to know about

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

Best Practices for Handling High-Cardinality Dimen...

WARN SSLCommon [53742 FwdDataReceiverThread] - Re...

What is the correct format for including the API k...

Service Principal configuration for Splunk Add-on ...

AWS VPC Flow logs getting ingested non-human reada...