Getting Data In

Community Activity

Are booleans in .conf files case sensitive? I am troubleshooting an issue with an app and the searchoperatorKV error I am receiving is: Invalid key-value parse... by samejgink Explorer in Getting Data In 03-19-2020 0 1	0	1
Volume configuration will not manage space used by this index We recently upgraded from 7.2.1 to 7.3.3 and from the _internal logs I can see that these new warnings are showing up... by DEAD_BEEF Builder in Getting Data In 03-19-2020 0 1	0	1
Universal forwarder fails to install credentials package on Linux (RPM / tgz) I followed the procedures in Get Data In tutorial for an Amazon Linux. Tried both the RPM and tar ball and got he s... by nilseupadilha Explorer in Getting Data In 03-18-2020 1 9	1	9
How to access "_indextime" to calculate "latency" in "metrics index"? For an events index, I would do something like this: \|tstats max(_indextime) AS indextime WHERE index=_* OR index=* ... by woodcock Esteemed Legend in Getting Data In 03-18-2020 2 2	2	2
Reset password of splunk service account (Used in installing UFs) Hi everyone, I have an issue in splunk UF installation in windows regarding the user, previously i did all the UF i... by salruwais New Member in Getting Data In 03-18-2020 0 1	0	1
indexes.conf sanity question. I wanted to ask here before making this change, for just another set of eyes. Issue. We have /hot and /cold both wit... by JDukeSplunk Builder in Getting Data In 03-18-2020 0 2	0	2
How can I filter a field using a lookup csv file? I have a csv file called ports.csv, this contains one column called "port", this contains all of the port numbers 0-1... by tomscott21 Engager in Getting Data In 03-18-2020 0 2	0	2
Cannot remove forward-server I have inherited an old on-prem Splunk 7.0.2 installation that I'm now trying to reconfigure to forward data to our ... by andreasknutsson Engager in Getting Data In 03-18-2020 0 3	0	3
Not able to Forward syslog data SOURCE=netscaler to ThirdParty throught port 514. Please help Hi All, Not able to Forward syslog data SOURCE=netscaler to ThirdParty throught port 514. Overrided source and tryin... by rajagurup New Member in Getting Data In 03-18-2020 0 0	0	0
How can I extend the historic performance data in the monitoring console? Hi, I am running a small cluster (2*I, 1SH, 1DS) and when I use the monitorig console on the deployment server it hap... by afx Contributor in Getting Data In 03-18-2020 0 0	0	0
Reading large Files using Splunk UF Hi, I am currently trying to read logs file of size 10Gb. I have changed thruput to 0 but still takes about 30 min-1... by akshatj2 Path Finder in Getting Data In 03-18-2020 0 1	0	1
Splunk search show results from JSON Hello, I have following JSON data coming in: {<!-- --> "event_timestamp" : "2020-03-03 T 12:56:54 +0200", "file_timesta... by panulpet Loves-to-Learn in Getting Data In 03-17-2020 0 10	0	10
Hostname in /var/log/messages All, The default hostname should be fine for my use cases with /var/log/messages brought in with the pretrained so... by daniel333 Builder in Getting Data In 03-17-2020 0 1	0	1
Opps. Passwords in UserID field You'd be surprised at how many times a user will type their password in the UserID field. This shows up in a Windows... by dokaas_2 Communicator in Getting Data In 03-17-2020 0 2	0	2
Complex line breaking configuration help needed Here is a snippet of a log file that I am trying to do line breaking on. I want it to only break when one line has ma... by jfaldmomacu Path Finder in Getting Data In 03-17-2020 0 8	0	8
Why am I getting errors with my SSL configuration between a universal forwarder and indexers? Hello Experts, I have a QA setup with 1 search head, 2 indexers and 1 universal forwarder. I have created the follow... by Raghav2384 Motivator in Getting Data In 03-17-2020 0 6	0	6
Why is the Windows Event Collector not parsing correctly? Hi Splunkers I have a problem with my Windows Event Collector (Windows Server 2012 R2). I'm not able to install a Un... by lukas_loder Communicator in Getting Data In 03-17-2020 0 9	0	9
LDAP Service Account Lockout We use LDAP authentication to log into Splunk. The AD service account we use for Splunk LDAP authentication gets rand... by johannterc New Member in Getting Data In 03-17-2020 0 2	0	2
Missing sourcetype from a particular device I have a list of 10 sourcetypes and a list of 14 ips . If a particular ip stops sending data for any sourcetype in la... by surekhasplunk Communicator in Getting Data In 03-17-2020 0 1	0	1
How to sent some metrics which are generated from splunk table to Grafana? Hello, I have a Splunk query which generates some output so I want to send this output to Grafana/premethes. So what ... by marisstella Explorer in Getting Data In 03-17-2020 0 1	0	1
Issues receiving syslog from Ubiquiti Dream Machine Im testing out Splunk for my home network and I'm running into an issue. I have configured my home router (Ubiquiti ... by tsmith8806 New Member in Getting Data In 03-17-2020 0 2	0	2
running log on splunk heavy forwarder I have a heavy forwarder onprem installed on a windows OS. I am troubleshooting why logs are not coming into the sp... by trojan_81 Path Finder in Getting Data In 03-16-2020 0 3	0	3
repFactor is not set to auto docker-splunk image Hi all, I'm working on deploying index clustering in kuberntes using docker-splunk image and faced with the following... by davidgreenibm New Member in Getting Data In 03-16-2020 0 4	0	4
Sourcetype missing We noticed that one of the sourcetype "wms_oracle_sessions" is missing. when we search the following queries, no re... by pratapa Explorer in Getting Data In 03-16-2020 0 1	0	1
Parsing Queue blocked on Heavy Forwarder Hey guys, I got some question regarding parsing queue issues I have been observing on our Heavy Forwarders. I am cur... by omuelle1 Communicator in Getting Data In 03-16-2020 0 2	0	2