Getting Data In

Community Activity

How to get non matching value by comparing two multivalued field without using join or append? I want to get value from one multivalued field which are not present in other multivaliued field from same index and ... by ankitgupta15 Engager in Getting Data In 01-13-2020 0 3	0	3
Forward matching events to a third party system. I would like to understand if the following requirement can be made to work.. We are ingesting AWS Cloudtrail events... by Stokers_23 Explorer in Getting Data In 01-13-2020 0 0	0	0
Filter events from UF based on source + sourcetype or host Hello, is it possible to filter events based on sourcetype + (host OR sourcetype) with props.conf/transforms.conf on... by splunkreal Influencer in Getting Data In 01-13-2020 0 4	0	4
How to separate hosts/other fields into other data indexes? I've got several data indexes (only one server) already that are separated by forwarders or listener ports. However, ... by bigfatyeastroll Path Finder in Getting Data In 01-13-2020 0 3	0	3
TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for key="Caption": Hi I get al lot of the following messages on my IX: TcpInputProc - Encountered S2S Exception=Invalid _meta atom: for... by aagehh New Member in Getting Data In 01-13-2020 0 4	0	4
SPLUNK could't parse all files in same directrory please need your support as SPLUNK didn't parse all files from same path, i.e for example in my inputs.conf there are... by Amirahussein Path Finder in Getting Data In 01-13-2020 0 1	0	1
How to do custom encryption and decryption on a Splunk universal forwarder? I am trying to do custom encryption and decryption of data on the universal forwarders. I am trying to configure the ... by dk30390 New Member in Getting Data In 01-13-2020 0 0	0	0
how to export a splunk app to .spl What is command that i need to use to export a splunk app into .spl format ? by chimbudp Contributor in Getting Data In 01-13-2020 2 5	2	5
Not able to read CSV from Universal forwarder I am trying to read csv from one of my universal forwareder, below is my inputs file [monitor://D:\DUMP\Updated_Dump... by shugup2923 Path Finder in Getting Data In 01-12-2020 0 4	0	4
KV_MODE = multi not capturing fields I am using the splunk for unix app and the KV_MODE = multi entry in props.conf is not working. For example, I am stil... by jamesvz84 Communicator in Getting Data In 01-12-2020 1 2	1	2
Question About Retetion Policy No Effect Hi, Splunkers: I have a question about retention policy that I had configured my index linux_log of frozenTimePeriod... by aojie654 Path Finder in Getting Data In 01-12-2020 0 2	0	2
Why did my data not deleted when reaching retention limit? Hi, Splunkers: I have a question about retention policy that I had configured my index linux_log of frozenTimePeriod... by aojie654 Path Finder in Getting Data In 01-12-2020 0 1	0	1
Custom timestamp detection for a sourcetype with some event w/o timestamp Hello there, For a particular sourcetype there are events with a timestamp and events without timestamp. As Splunk ... by D2SI Communicator in Getting Data In 01-11-2020 0 9	0	9
How to convert JSON array of Key/Value pairs to Column/Value? Lets say we have Json data in the following format ( using 2 events as an example) Event 1) Time Event 5/19/19 2... by mlevsh Builder in Getting Data In 01-10-2020 0 4	0	4
Parse json - relate parent key to child-array values Source JSON Structure: { "working": { "https://site.number.one": [ { "metric": "... by n_young New Member in Getting Data In 01-10-2020 0 6	0	6
json output read single value when there are multiple for a segment Hi, I have a json output which is getting indexed correctly. And i am collectng ip from remotemanagement{}.ip . But ... by surekhasplunk Communicator in Getting Data In 01-10-2020 0 11	0	11
KV store keys, REST API and URL encoding forward slashes I have a KV collection that uses a CIDR-style network address as the key value. This means that delete operations ... by hughkelley Path Finder in Getting Data In 01-10-2020 0 6	0	6
Is there a way to delay splunk universal forwarder from monitoring specific files? Hello, We have an issue monitoring os_metrics logs where the log entries are generated from a Windows command wmic a... by swamysanjanaput Explorer in Getting Data In 01-10-2020 0 4	0	4
Index main Hello Splunkers! I have a question, i have installed a universal forwarder on a AIX server, but all the logs arrives... by juls0125 New Member in Getting Data In 01-10-2020 0 3	0	3
Wildcards not working in tags.conf I have the below config in tags.conf: [source=/some/directory/logs/foo-bar/error.log] sometag = enabled And this wo... by dhughesanz New Member in Getting Data In 01-10-2020 0 1	0	1
Configure Spunk Hot/Warm, Cold and Frozen How do I configure HOT / WARM, COULD, and FROZEN in Splunk Enterpise? I need to configure Splunk Data Retention and ... by erlindemberg Explorer in Getting Data In 01-10-2020 0 2	0	2
Need seperate count for UP and DOWN Peer Hi All, I have a query to display some BGP neighbour UP or DOWN. Output looks like nodelabel Status PEER_IP Ti... by jerinvarghese Communicator in Getting Data In 01-10-2020 0 5	0	5
Why did a Splunk forwarder stop sending to log packet? It was working fine until 1 month ago. There was no Splunk forwarder and network configuration change. No packets fro... by lifekis Explorer in Getting Data In 01-09-2020 0 5	0	5
Add hosts to Splunk multiselect UI I want to populate the list of hosts in the multiselect input option in Splunk. index=someIndexName * host!="notThis... by kirti_gupta12 Path Finder in Getting Data In 01-09-2020 0 1	0	1
Windows Security Events only being forwarded for a short time after restarting universal forwarder Hi everyone, I have about 20 windows servers and 30 linux servers, all with universal forwarders installed and config... by mccartneyc Path Finder in Getting Data In 01-09-2020 0 1	0	1