Getting Data In

Community Activity

How to tell splunk to read log files only once, but keep monitoring the folder for new files? I have an ActiveBatch setup that generates many files (tens of thousands) in a folder. I'd like to have Splunk read o... by zsimic Path Finder in Getting Data In 09-17-2019 2 3	2	3
Nested JSON issues with Spath Hi, First time poster also fairly new to splunk though I am fluent in Python and decent at sql so apologies if this p... by leon_r New Member in Getting Data In 09-17-2019 0 2	0	2
Import CSV data, multiple events on single line Hi guys, I have a report in CSV format that disappointingly the product exports only monthly reports and puts each da... by jmeager_splunk Splunk Employee in Getting Data In 09-17-2019 0 4	0	4
after indexing data can we change the time stamp year in splunk ??? in same index Hello,... i have loaded my data into splunk thats 2017 data i need to change the year of the data in index. because ... by salmanbpc New Member in Getting Data In 09-17-2019 0 1	0	1
Why does Splunk custom endpoint time out automatically after 500 seconds Hi, We have distributed Splunk deployment running version 7.3.0. We have a custom REST endpoint which runs some sear... by keerthana_k Communicator in Getting Data In 09-17-2019 0 0	0	0
JSON - Duplicated Fields Splunk Enterprise 7.0.2 Can't get rid of duplicated fields indexed in a json format. I tryied all combinations, in I... by verbal_666 Builder in Getting Data In 09-17-2019 0 4	0	4
REST API: How do I limit saved searches to a specific app? I'm trying to list names and ID all the saved searches in a given app by specifying the app in my HTTP request, like ... by niall_munnelly Path Finder in Getting Data In 09-17-2019 0 1	0	1
CSV Import Hi, i currently have a huge csv file (255.000 rows) that i want to Import into a specific index. If i add it manualy... by DanielAmlung Path Finder in Getting Data In 09-17-2019 0 0	0	0
Using sedcmd to truncate QPM= Hi Everyone, Wondering if anyone has a solution to an issue I'm having truncating out some values we deem to be "jun... by eoc New Member in Getting Data In 09-17-2019 0 6	0	6
Windows Perfmon data routing issues I am trying to get Windows Perfmon data in. I have been successful for some servers but not others, despite using the... by kbakeragx New Member in Getting Data In 09-16-2019 0 1	0	1
UFW: Collect WMI instance referenced in monitored WMI event I have what is probably a very newbie question: I would like to monitor a WMI event with Splunk. This event returns ... by injvstice New Member in Getting Data In 09-16-2019 0 0	0	0
Is it possible to force data to freeze? We, up to now, have never frozen data. However, we have a requirement now to freeze some data for years. I need to ... by tsheets13 Communicator in Getting Data In 09-16-2019 0 7	0	7
Best practice when data is imported wrong? What would be the best practice / standard operating procedure when data is imported wrong into Splunk? I imported a... by kfelts68 Explorer in Getting Data In 09-16-2019 0 1	0	1
Field extraction and field alliasing not working I need to rename field and calculate some field as I mentioned below but it not working at all. [Workday] INDEXED_... by pal_sumit1 Path Finder in Getting Data In 09-16-2019 0 2	0	2
Heavy Forwarder Kept sending logs after splunk was uninstalled from host. The only explanation I could think was that it was not uninstalled properly or it was over riding data somehow or it ... by tbyrne15 New Member in Getting Data In 09-16-2019 0 1	0	1
Is it better to have 1 big indexer or 2 small indexers per site in a multisite indexer clustering environment? Hi, I'm planning on deploying a Splunk infrastructure. I'm currently undecided whether I should build the infrast... by horsefez Motivator in Getting Data In 09-16-2019 0 3	0	3
Monitor all remaining files not specifically matched We have several syslog-ng collectors with UFs on them. The UF monitors the paths and files that syslog-ng generates ... by davidstuffle Path Finder in Getting Data In 09-15-2019 0 3	0	3
How to fix line breaking issue Unix timestamp Hi All, I have the logs in below format which is stored in an S3 bucket : 1567295878959445,hostname,ip,id,session,... by samadmemon Explorer in Getting Data In 09-15-2019 0 9	0	9
Can someone explain the triggers stanza in props.conf? All, I noticed a [triggers] stanza in an app I Just made with the AppBuilder in props.conf. Anyone have some docume... by daniel333 Builder in Getting Data In 09-15-2019 0 1	0	1
Do Universal Forwarders allow for bursts of data before starting to throttle? The universal forwarder in our setup is forwarding data to a single indexer and the max KBps is set to the default va... by joshhealey13 Engager in Getting Data In 09-15-2019 3 3	3	3
Python SDK [list of inputs in input.conf] Hi, i have 40 inputs [type: monitor] configured in one inputs.conf. Let's call them 001, 002, 003, .... 040 i'm usi... by fklink New Member in Getting Data In 09-15-2019 0 0	0	0
Failed to receive logs from Docker with Splunk Logging Driver Hi all, I followed the instruction in https://github.com/splunk/docker-logging-plugin to install the log driver, and... by xzou_splunk Splunk Employee in Getting Data In 09-14-2019 0 0	0	0
Anyone have a good search to compare todays hosts against yesterdays? All, I'd just like a report sent to me daily of list hosts names appearing in Splunk in the last 24 hours. Guessi... by daniel333 Builder in Getting Data In 09-14-2019 0 4	0	4
Is it possible to update the Splunk Universal Forwarder but not change anything else? I have some old versions of Splunk lying around and want to just do an update, not change the directory being monitor... by raidermike2 New Member in Getting Data In 09-13-2019 0 1	0	1
Why does my Splunk forwarder transmit incomplete events for my rsyslog server? Hi folks, I have a problem with Splunk forwarder on my centralize rsyslog server, exactly it's with the maillog even... by tboutry Explorer in Getting Data In 09-13-2019 2 7	2	7