Getting Data In

Community Activity

could not use strptime to parse timestamp Feb 18 18:36:20 smtp2 sm-mta[17872]: l1J0a3fO017872: discarded I have one sample event. when I this it gives me "co... by riqbal47010 Path Finder in Getting Data In 04-17-2020 0 5	0	5
change date of import data hi i'm copy log of my application to splunk server with script (i don't use forwarder here) now problem is log send... by indeed_2000 Motivator in Getting Data In 04-17-2020 0 3	0	3
How does splunk reassamble chunks of data coming from UFs in an indexer cluster ? By default, UFs are sending chunks of 64kB data and spread these over multiple indexers. But indexers are supposed to... by yoho Contributor in Getting Data In 04-17-2020 0 4	0	4
How can I get more than 10,000 lines into a single event? I want more than 10,000 lines to merge and show in a single event. [tally_nightly_prd] SHOULD_LINEMERGE=true NO_BINA... by payal23 Path Finder in Getting Data In 04-16-2020 0 10	0	10
Rex pattern to extract unc path from xml I like to extract the UNC path from a log, below a portion from the file : ;<soa:FileSystem identifier="8ec65285-11ac... by splunk2019tlmd Engager in Getting Data In 04-16-2020 0 3	0	3
Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search? I have two indexers in peer that share 1 index, and 1 data model. Both indexers are configured identically. Both da... by mcrawford44 Communicator in Getting Data In 04-16-2020 4 11	4	11
how to force all data to go to a different index? How do I force all data to go to a different index without inserting index=foo for all input stanzas? by matt Splunk Employee in Getting Data In 04-16-2020 0 2	0	2
500 Internal Server Error out of splunklib/binding.py I'm seeing this error message stream when the TA-ObserveIT tries to get what I think is the configuration information... by jwhughes58 Contributor in Getting Data In 04-16-2020 0 0	0	0
Why am I getting "404 Not Found" for every REST API call? I am using the following query as per documentation: curl -k -u username:password http://myhosthere:8000/services/se... by nsshey Explorer in Getting Data In 04-16-2020 0 4	0	4
KV_MODE not extracting xml fields I have an app on a deployment server that runs a script and has splunk ingest the output which is valid xml. I've add... by willcwhite Explorer in Getting Data In 04-16-2020 0 6	0	6
Getting containerized universal forwarder to forward host log files I would like to be able to run the forwarder in a container, and have it forward my host logs from /var/log. So I mo... by patrickkutch New Member in Getting Data In 04-16-2020 0 0	0	0
Splunk indexed data into Azure datalake storage or Blob storage Is there any way to send already indexed splunk data (from one index) into Azure data lake storage or Azure Blob stor... by saikiran334 Explorer in Getting Data In 04-16-2020 0 0	0	0
Change index depending on host Hi all, I'm trying to split Windows events into different indexes at index time depending on the host which is sendi... by pbalbasdtt Path Finder in Getting Data In 04-16-2020 0 7	0	7
Looping in csv items to count how many values matches in a index Hi all, starting from a csv which contains 10 items, I want to count ( in order to produce a chart ) all the matches ... by fabrizioalleva Path Finder in Getting Data In 04-16-2020 0 0	0	0
in the multiselect input how to give user option to choose AND or OR Hi, I have dynamic users in the input type which i am populating in multiselect Now i want to give the user the optio... by surekhasplunk Communicator in Getting Data In 04-15-2020 0 2	0	2
file monitor input only ingest last 200 bytes of the file Hi guys, I need to on-board some log files, but only the last 200 bytes of each log files contain useful information... by season88481 Contributor in Getting Data In 04-15-2020 0 3	0	3
How to check how long splunk uf agents are down on particular servers? Hi , We had list of servers a,b,c,d,e,f. How can we check how long splunk uf agents are down on the servers a,b,c,d... by splunker969 Communicator in Getting Data In 04-15-2020 0 16	0	16
Monitoring Console - Deployment-Wide Averaged System Load Average How would we interpret the "Deployment-Wide Averaged System Load Average" Monitoring console indexing metrics? When ... by gduggan1 Path Finder in Getting Data In 04-15-2020 0 0	0	0
How to index an XML file with unix time format I have XML files in my PC that I want to index them in Splunk, I need the inputs and the props.conf changed. I did ev... by almotasim90 New Member in Getting Data In 04-15-2020 0 1	0	1
Unable to filter specific events with props.conf & transforms.conf I've been reading into how to filter incoming events between the Parsing and Indexing stages of our data pipeline and... by marshallsuk Engager in Getting Data In 04-15-2020 0 3	0	3
Source type for dmesg log file I was wondering if anyone had a good solution for a proper source type for dmesg? Or failing that some way of handli... by scottj1y Path Finder in Getting Data In 04-15-2020 0 5	0	5
How to monitor user activity (logon and logoff) Hello, Excuse my lack of expertise with Splunk. Could you please let me know how i can track when a specific user lo... by gntavelis New Member in Getting Data In 04-15-2020 0 9	0	9
how to configure inputs.conf? i have logs like this : -rw-r----- 1 jira jira 4921534 Apr 13 22:42 catalina.2020-04-13.log -rw-r----- 1 jira jir... by khandelwaly Explorer in Getting Data In 04-15-2020 0 17	0	17
Heavy Forwarder Installation version compatibility Currently we are running with Splunk Cloud 7.2.9.1 version the same applicable for indexers ,cluster master and searc... by anandhalagaras1 Contributor in Getting Data In 04-15-2020 0 1	0	1
How to split data based on a field I have the following query: ns=name* TEST_DECISION PRODUCT IN (PRODUCT1) \| timechart span=1d limit=0 count by TEST_... by angersleek Path Finder in Getting Data In 04-15-2020 0 7	0	7