Getting Data In

Community Activity

Json event breaking not working as expected Original log: [{"username": "xxx", "event": "session_start", "event_category": "session", "timestamp": "2019-12-11 0... by kishor_pinjarka Path Finder in Getting Data In 12-20-2019 0 2	0	2
How to find hosts without logs by time? Hi I have a query which finds hosts without logs for the whole search and it looks like this: \| inputlookup hosts.c... by skottska New Member in Getting Data In 12-20-2019 0 3	0	3
Looking for suggestions on how to mask email addresses that could be in almost any format in a JSON? I have a JSON with an agonizing amount of PII which is mostly email addresses, but it is in no standard format and no... by lycollicott Motivator in Getting Data In 12-19-2019 0 1	0	1
After following instructions for Fundamentals Lab 4 to ingest data from three files the Search page shows "Waiting for data..." Ingestion was successful, why is it not avaiable? I followed the instructions in Lab 4 of the Fundamentals training to ingest data from three files. The files were su... by kevinwwebster New Member in Getting Data In 12-19-2019 0 0	0	0
Unable to see logs on Splunk Cloud from some servers There are 300 servers sending logs to the Heavy forwarder. The same common application is successfully deployed in al... by asharma21193 New Member in Getting Data In 12-19-2019 0 0	0	0
How to edit my configurations to forward syslog to a third party using a Heavy Forwarder? Hello guys, today i was able to send some syslogs to another non-Splunk instance, however when i tried to send 1 typ... by rgb22 New Member in Getting Data In 12-19-2019 0 4	0	4
Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud? We use Splunk Cloud and have 3 Heavy Forwarders (which I updated yesterday with the new datetime.xml). We also have ... by jgaccornero Explorer in Getting Data In 12-19-2019 0 2	0	2
Why is Splunk_TA_nix not using default sourcetypes for /var/log/messages? All, I have a relatively default setup for Splunk_TA_nix on centOS 7 and /var/log/messages is coming in as sourcety... by daniel333 Builder in Getting Data In 12-19-2019 0 1	0	1
Timestamp recognition issue Dear All, We are getting notification of from splunk on time stamp recognition issue from jan 1 2010 it will be effe... by santosh11 New Member in Getting Data In 12-19-2019 0 4	0	4
Access email settings via API Hello team, In order to change the email settings from GUI I can go to Settings > Server Settings > Email Settings an... by mastoras Explorer in Getting Data In 12-19-2019 0 1	0	1
Getting metadata such as host, source, and source type when sendCookedData is set to false ? Actually I need all the event changes from Splunk forwarders(Universal and Heavy both) into a third party system, so ... by dk30390 New Member in Getting Data In 12-18-2019 0 0	0	0
When ingest archive data,what should be took care? When ingest archive data(e.g. bz2,zip,tgz),What should be took care? I think that it's need more cpu time to ingest a... by basplunk New Member in Getting Data In 12-18-2019 0 0	0	0
Tuning my linux_secure sourcetype All, I am seeing parsing queue slow downs when large sets of linux_secure data comes in. After talking with support... by daniel333 Builder in Getting Data In 12-18-2019 0 1	0	1
Disabling Transparent Huge Pages on Splunk docker release I recently learned, using SplunkAdmins app that I should disable Transparent Huge Pages on my Splunk Enterprise host.... by reallyliri Explorer in Getting Data In 12-18-2019 0 1	0	1
Logging Scanners & Digital Senders Hello All, I recently set up Splunk logging for all networked printers. I thought the process would be the same for ... by rburton83 Engager in Getting Data In 12-18-2019 0 1	0	1
Timestamp format with leading hash sign, #Fri Aug 31 14:37:21 2012 Any suggestions on the format that I could use to extract this timestamp? #Fri Aug 31 14:37:21 2012 thanks, James by jmgilpin New Member in Getting Data In 12-18-2019 0 2	0	2
Line breaking : problem with blank lines ? Hi experts, I'm collecting logs wich look like this : 2019-12-18_09:51:42.982 [] [req-] INFO ParGideBS.getByCle b... by DavidCaputo Path Finder in Getting Data In 12-18-2019 0 1	0	1
Index By host OR Sourcetype by host Hello, I have 2 questions I am hoping someone can help me with. I am trying to figure out how to categorize data bas... by jamie_leclair Engager in Getting Data In 12-18-2019 0 10	0	10
How to call $SPLUNK_HOME or %SPLUNK_HOME% from a .bat file for Windows Scripted input? I have a working scripted input using the first method below, however I'm wanting to get rid of the hard coding of SP... by bandit Motivator in Getting Data In 12-17-2019 0 8	0	8
syslog-ng props and transforms conf for ingesting data Hi! I'm trying to ingest metric data from a Virtual Machine Linux box, using syslog-ng and Splunk Universal Forwarde... by chrisratliff95 New Member in Getting Data In 12-17-2019 0 0	0	0
Run universal forwarder in Docker as unprivileged account I am trying to run the universal forwarder in OpenShift which by default doesn't allow containers to run with a privi... by adamstortz Engager in Getting Data In 12-17-2019 1 1	1	1
How find index-time field extractions. Hello all, Our environment has some custom index-time field extractions we find to be very useful (yes, I know Splun... by adamsmith47 Communicator in Getting Data In 12-17-2019 0 2	0	2
Problem with my search (activity log on of 3 users , Active directory) Hello everybody, (Sorry for my english) splunk version 7.0.0 I have two problems on my search I am searching the ac... by tinpelayee Engager in Getting Data In 12-17-2019 0 1	0	1
How do I copy forwarder inputs from one indexer to another indexer? I'm working on load balancing the universal forwarder and want to make sure the additional indexer that will now rece... by ntripp_element Explorer in Getting Data In 12-17-2019 0 3	0	3
Hostname macro in inputs.conf Hi, I have a Linux based application server that exists in two copies on xhostA and xhostB. I am getting their syslog... by afx Contributor in Getting Data In 12-17-2019 0 1	0	1