Getting Data In

Community Activity

Highlight specific string in JSON formatted events Hello, I have a dashboard where I am displaying events which are JSON formatted (a requirement not to have them in r... by gustavlundberg New Member in Getting Data In 02-12-2020 0 2	0	2
RBAC without using indexes Is it possible to do RBAC without indexes ? I have 5 indexes at least, but I can’t use indexes to do RBAC because all... by nouh_hussein New Member in Getting Data In 02-11-2020 0 3	0	3
Is there JSON model validation in Splunk? Hello, I have complex json being written to splunk and want to do model file validation , what is the best way to do ... by msrama5 Explorer in Getting Data In 02-11-2020 0 4	0	4
not able to browse Splunk Cloud HEC end point I am not able to access my HEC URL, can you please help me? I am using Free Splunk cloud and setup an HEC and enabled... by vemulasplunk Explorer in Getting Data In 02-11-2020 1 1	1	1
Crashplan Service Log Date timestamp incorrect I've looked through a lot of the posts about date timestamp extraction and I think I'm decent enough at it but for th... by bmorgenthaler Path Finder in Getting Data In 02-11-2020 0 3	0	3
How to configure Splunk to parse and index JSON data I got a custom-crafted JSON file that holds a mix of data types within. I'm a newbie with Splunk administration so be... by berryk New Member in Getting Data In 02-11-2020 0 8	0	8
Default index for all splunkforwarder monitors? I want all forwarders on a single splunkforwarder box to send data to the same specified index. I'd like to avoid ha... by Jordan_Brough Path Finder in Getting Data In 02-11-2020 0 3	0	3
script input not working when parameter is passed as a variable and not the static value in inputs.conf Hi All, I am using a script to fetch http response as splunk raw event. For this I am passing parameter as a variabl... by sara91 Explorer in Getting Data In 02-11-2020 0 3	0	3
Error: Invalid key stanza Hi Team, I am getting below error in spluk local insatance : Error details : Invalid key in stanza [tc... by 02sangeet Engager in Getting Data In 02-11-2020 0 2	0	2
file monitoring in server for size and modified date We have folder directories on the Application server and collecting data through forwarder. i need to calculate file ... by DataOrg Builder in Getting Data In 02-11-2020 0 1	0	1
Http event collector vs monitor directory I have Splunk Universal Forwarder installed on raspberry pi and couple of apps from which I want to send logs to forw... by signumpl Engager in Getting Data In 02-11-2020 0 1	0	1
How to edit my type=host metadata search to exclude a certain index? I have this search: \| metadata type=hosts index=*a OR index=os index!=aruba I want to get all the hosts in all the... by hartfoml Motivator in Getting Data In 02-11-2020 0 10	0	10
Missing events from Splunk Universal Forwarder I have one missing event out of 168 events from our Universal Forwarder. I've already checked the internal logs and t... by iancorrea Path Finder in Getting Data In 02-11-2020 0 5	0	5
Is it possible to force an Universal Forwarder to use an specific ip address for the connection to the indexer/hf? We have several Universal Forwarders installed on different Linux machines. Due to the virtualization technology, eac... by ayoldi Explorer in Getting Data In 02-11-2020 0 14	0	14
replicationStatus Failed failure info: failed_because_HTTP_REPLY_ERROR_CODE Hi guys, I'm getting the following message in one of the indexers from the cluster. "DistributedPeerManager - Unabl... by pbalbasm Path Finder in Getting Data In 02-11-2020 0 1	0	1
Calculated field configuration (EVAL) not working in props.conf I am trying to use a filed in calculated fields from props.conf to replace space in one of my field values but not ge... by 513239 Explorer in Getting Data In 02-11-2020 0 7	0	7
How to include medium-large texts with the events? I'm developing an inotify-based daemon to report core-dumps occasionally occurring in a directory. Reporting the fac... by unitedmarsupial Path Finder in Getting Data In 02-10-2020 0 2	0	2
how to set TIME_PREFIX for a json file? I have a JSON file like this. {<!-- --> "ACC_NAME": "A", "DEPT": [{<!-- --> "NAME": "D1", "PROJECT": [{<!-- --> ... by anooshac Communicator in Getting Data In 02-10-2020 0 9	0	9
Splunk add-on for New Relic -- Getting Error : ValueError: No JSON object could be decoded Hello All, Trying to setup Splunk add-on for New Relic and getting this errors in the logs : ValueError: No JSON obj... by jdedev Loves-to-Learn in Getting Data In 02-10-2020 0 1	0	1
Why am I unable to install a universal forwarder using CMD? Hi, I'm trying to install Universal Forwarder using the command below: -> msiexec.exe /i “C:\USERS\%USERNAME%\Deskt... by jsantos1 Engager in Getting Data In 02-10-2020 1 4	1	4
How to save the CSV file to external location I would like to save the CSV file to an external location. I am using the \|outputcsv command which is saving the fil... by khumer Explorer in Getting Data In 02-10-2020 0 5	0	5
How to convert JSON into specific table format This what we have in logs: index="xyz" INFO certvalidationtask And this prints a JSON object which consists of a l... by rsharma1984 Explorer in Getting Data In 02-10-2020 0 5	0	5
Unable to upload dSYM file and receiving error message I'm trying to upload dSYM file from the UI https://mint.splunk.com/dashboard/project/XXX/settings/dsyms but getting a... by sonicroy New Member in Getting Data In 02-10-2020 0 0	0	0
what would be the perfect props.conf for this event Date=2020-02-10\|StrtTime=09:56:08\|EndTime=09:56:08\|Duration=7\|EvntType=MSG\|UUID= props that i am using : TIME_PREFI... by abhishekkalokhe Explorer in Getting Data In 02-10-2020 0 1	0	1
Allowed characters for metadata fields source and sourcetype My question is simple: which characters are allowed for the values of the metadata fields source and sourcetype? I c... by helge Builder in Getting Data In 02-10-2020 0 6	0	6