Getting Data In

Community Activity

After creating a new index on the master and distributing it to the peer nodes, why do I not see the new index on my heavy forwarder? Hey all, My setup consist of 1 search head, master, 4 peer nodes. I'm using a heavy forwarder to get data in. I've ... by Defiant81 Explorer in Getting Data In 10-17-2019 1 4	1	4
\| rest /services/cluster/master/peers I have a SH cluster and an Index cluster all running 7.1.7. I'm trying to access the cluster/master/peers endpoint by... by _smp_ Builder in Getting Data In 10-17-2019 0 2	0	2
Heavy forwarder internal logs to splunk cloud Hi All, Hope you all are doing well. I ran into a issue that heavy fowarders are not sending internal logs to Splun... by bhsakarchourasi Path Finder in Getting Data In 10-17-2019 0 2	0	2
How many indexes should I use? Hello All, I have some sizing questions and wanted some input from the community. I'm pretty sure the answer, like ... by andrewtrobec Motivator in Getting Data In 10-17-2019 0 1	0	1
How to get earliest and latest from time filter? I am using a dashboard with some filters including the built int time input for the events. For the queries in the c... by asubramanian Explorer in Getting Data In 10-16-2019 0 7	0	7
Forwarder Resend Data After Connect To Indexer Hi, Splunkers: I have a forwarder that is target to a incorrect indexer and it was paused to send data for 3700s. N... by aojie654 Path Finder in Getting Data In 10-16-2019 0 12	0	12
trouble with extracting data from JSON event Hi, I am storing the events containing subscribers per subscription topics. The events look like this: {"type":"sub... by lwiechec New Member in Getting Data In 10-16-2019 0 1	0	1
Tonight i got a new host appear by mistake... here is the host but when i try to search for it nothing... host="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x... by darkwall New Member in Getting Data In 10-16-2019 0 2	0	2
How to capture Windows evtx files A customer has asked me to pick up the following logs: %SystemRoot%\System32\Winevt\Logs\Application.evtx %SystemRoo... by nls7010 Path Finder in Getting Data In 10-16-2019 0 3	0	3
Proper formatting (identation) of queries in savedsearches.conf stanza causes everything after the first \| pipe to be ignored Hi splunkers, I'm convinced that following clean code principles starts with proper indentation. That's why all my ... by ramgnisiv Path Finder in Getting Data In 10-16-2019 0 3	0	3
Monitor hosts I would like to monitor 10 hosts on a Splunk server. is that possible? What are the steps to monitor clients or hosts... by ammul440 New Member in Getting Data In 10-16-2019 0 10	0	10
How to get tcp-ssl input for Splunk 6.0 to work I have installed Splunk 6.0 (Free version) on Linux x64 system. I can collect syslog inputs on UDP port 514. But I tr... by ricktao Explorer in Getting Data In 10-16-2019 2 9	2	9
Original splunk container fails to start (RHEL 7.6 + Docker 1.13.1-103) -- but works fine on CentOS 7 Loading a new and unmodified splunk container throws an error and cannot start on RHEL 7.6 The docker image has been ... by justunix New Member in Getting Data In 10-16-2019 0 0	0	0
json to table Hi Experts, I want to convert Json format into table. My data have below field [ [-] { [-] day: Tue da... by arun_kant_sharm Path Finder in Getting Data In 10-15-2019 0 4	0	4
JSON Parse error while uploading .kmz - 7.2.0 Having some issues trying to upload a .kmz file.. It's working fine on the 7.3.1 sandbox I have myself, but trying to... by m_newman New Member in Getting Data In 10-15-2019 0 0	0	0
Error - saving custom sourcetype data cannot be written Error when trying to save sourcetype : In handler 'sourcetypes': Data could not be written: /nobody/destinations/prop... by shhhhh New Member in Getting Data In 10-15-2019 0 2	0	2
Receiving error after restarting docker-splunk, proceeds to add forward-server Hi, I am setting up a Splunk universal forwarder by pulling the universalforwarder docker image from docker-hub and ... by chibhat New Member in Getting Data In 10-15-2019 0 0	0	0
Need to limit iis logs to 4xx and 5xx statuses in universal forwarder I am trying to limit the input of iis logs to only 4xx and 5xx vaqlues in the sc_status field. In the etc\system\loc... by agatesoftware New Member in Getting Data In 10-15-2019 0 1	0	1
What are the best practices for assigning time zones in my Splunk platform deployment? When setting up my Splunk deployment, I was asked about what timezone I want the servers to have. I just assumed I sh... by sloshburch Ultra Champion in Getting Data In 10-15-2019 0 1	0	1
Session Duration in minutes I have a search that returns the "Avg Session Duration" by USER_ID. The results are coming back in minutes as long a... by JoeSco27 Communicator in Getting Data In 10-15-2019 0 4	0	4
Why does Splunk "Show Source" not match IIS log file? Hi, At my company, we have noticed that for some records (1-2%), the data we see in Splunk does not match the data c... by pzhou07920 Explorer in Getting Data In 10-15-2019 0 6	0	6
UF is not sending few logs Hi All, I have UF installed in my windows machine and its has IIS logs and App logs. In last few days, my forwarder ... by arunkns New Member in Getting Data In 10-15-2019 0 5	0	5
JSON line breaking I am trying to break one big json event into several events, eventually 1080, but in the example below there would be... by mcbradfordwcb Engager in Getting Data In 10-14-2019 0 1	0	1
How to send data via UDP port to 2 indexers? Hi Experts, I have a concern. I am aware that I can get data from UDP port and send it to an indexer. I have a conce... by vikas_gopal Builder in Getting Data In 10-14-2019 0 6	0	6
Does Splunk ingest files that existed before the remote folder monitor was created? I have a client server with a universal forwarder configured to forward data to an index server. On the client serve... by williamcharlton Path Finder in Getting Data In 10-14-2019 0 2	0	2