Getting Data In

Discussions

Thread Info

How to set a regex to break each host_details line out individually in props?

I have a script that feeds Syslog to a TCP port on a Heavy Forwarder box that is EOL. I set up a new AWS HF and sent ...

by Builder in

partially rewrite event index name based on sourcetype value

Hello, I already know how to statically rewrite the index value based on a sourcetype. Typically using something s...

by Communicator in

Password policy logs in Active Directory.

Hi Splunker; Is there way for Splunk monitor password policy in AD, such as; what is content this policy about how...

by Path Finder in

Extracting Fields using Regex

Hi All, TIME_PREFIX= MAX_TIME_LOOKAHEAD= LINE_BREAKER= Below are the logs which need to be extracted. Kindly h...

by Explorer in

Extract multiple jsons from array

Hi all . This is an example of a json i'm sending to my Splunk cloud. { "workers": [ { "UserID": 1...

by Explorer in

Standalone transforms.conf stanza (not called in props.conf) without warnings

Hello, In a particular TA, I had to use a standalone transforms.conf stanza : [standalone_stanza] REGEX = (.+?)...

by Communicator in

Symantec Endpoint 14 via syslog onboarding

Apologies first, for the long post; I'm trying to get clarification on some previous posts, hopefully this post can c...

by Engager in

Scripted Input Cron Schedule not working correctly

I have the following inputs.conf for a scripted input. However this is not working as per what I thought it would. Th...

by Path Finder in

Splunk indexers cluster

Hi, I have a lab setup with 1 SH, 1 Master node, 2 indexers peers. My question is, which one of the indexers should a...

by Explorer in

Who is sending to my heavy forwarder?

I'm getting a lot of parsing errors on my heavy forwarders ...Failed in pcre_exec: Error PCRE_ERROR_MATCHLIMIT... but...

by Explorer in

Monitor Windows IIS Log File

I am not sure where I have gone wrong but I am trying to take in logs from a number of IIS web servers. The log files...

by Contributor in

Why splunk can directly read and parse the csv file uploaded?

Why splunk can directly read and parse the csv file uploaded? Is it possible for me to see the config file doing this...

by New Member in

Is it possible to initiate a curl command from a dashboard?

Hi all, I created a job in Rundeck that lets you select a Splunk app and a time period, then enables/disables the app...

by Explorer in

Is Splunk's "syslog-host" REGEX in $SPLUNK_HOME/etc/system/default/transforms.conf broken?

In $SPLUNK_HOME/etc/system/default/ we find this troublesome configuration in transforms.conf: [syslog-host] DEST_...

by Esteemed Legend in

How can I test that a heavy forwarder on a limited subset of endpoints?

Is there a way to modify a .conf file or a setting on an individual endpoint to only send data to a single heavy forw...

by New Member in

Is there a way to force UF to phone home to DS?

Hi All, I just want to ask if there's a way to force UF to phone home to DS, we want to initiate a force phone hom...

by Communicator in

Need help in getting wineventlogs to go to a new index rather than the main index

I set up a new index for one of my groups. In it they want to store their servers wineventlogs. I am unable to succes...

by Path Finder in

Splunk event sourcetype overide and send event back to parsing queue

I have a situation where I have to parse the data, especially timestamp extraction based on the keyword in the messag...

by Contributor in

Script command : Error in 'script' command: The external search command Error

Hi I'm having issues while running script command within the search. I've tried running something like .. | sa...

by Super Champion in

How do I know the title of my system index

I have read through the documentation and still feel that I am missing something with creating an index summary. I wa...

by Contributor in

Need a help with posting data using Rest API's from one Splunk to another

Hello, I have my own Splunk where I installed SPLUNK ES and I just got the Search head access from somebody's SP...

by Communicator in

index based on first three characters of hostname

Hello, I am trying to implement setting a specific index based on part of the hostname. For ALL of my data that I...

by Path Finder in

Index only first Occurrence of string in events

I want to know if below things are possible in splunk and if YES then How it can be achieved- 1. Below is sample even...

by Builder in

using source in props.conf to break the below event based on realm .

I am trying to break the event based on the realm in the below example. My sourcetype "Iam_logs" is defined globally ...

by Observer in

HTTP Event Collector on Heavy forwared

I want to configure HTTP Event collector on one of the Heavy forwarder. initially i create the app with named splunk...

by Path Finder in

Get Updates on the Splunk Community!

Getting Data In

Discussions

How to set a regex to break each host_details line out individually in props?

partially rewrite event index name based on sourcetype value

Password policy logs in Active Directory.

Extracting Fields using Regex

Extract multiple jsons from array

Standalone transforms.conf stanza (not called in props.conf) without warnings

Symantec Endpoint 14 via syslog onboarding

Scripted Input Cron Schedule not working correctly

Splunk indexers cluster

Who is sending to my heavy forwarder?

Monitor Windows IIS Log File

Why splunk can directly read and parse the csv file uploaded?

Is it possible to initiate a curl command from a dashboard?

Is Splunk's "syslog-host" REGEX in $SPLUNK_HOME/etc/system/default/transforms.conf broken?

How can I test that a heavy forwarder on a limited subset of endpoints?

Is there a way to force UF to phone home to DS?

Need help in getting wineventlogs to go to a new index rather than the main index

Splunk event sourcetype overide and send event back to parsing queue

Script command : Error in 'script' command: The external search command Error

How do I know the title of my system index

Need a help with posting data using Rest API's from one Splunk to another

index based on first three characters of hostname

Index only first Occurrence of string in events

using source in props.conf to break the below event based on realm .

HTTP Event Collector on Heavy forwared

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Observability protocols to know about

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WARN SSLCommon [53742 FwdDataReceiverThread] - Re...

What is the correct format for including the API k...

Service Principal configuration for Splunk Add-on ...

AWS VPC Flow logs getting ingested non-human reada...

Configuring Splunk OTel Collector for Linux/Window...