Getting Data In

Community Activity

Why are we seeing an issue with an EXTREMELY busy forwarder bogging down our indexers? Recently, indexing from that particular forwarder has gotten to be even slower, sometimes falling hours behind. I'm c... by ChadLangUAB Path Finder in Getting Data In 08-13-2019 0 4	0	4
Can default certificate be used for communication between universal forwarder and heavy forwarder in Splunk cloud? I am pretty new to splunk. We are implementing heavy forwarder on EC2 instance which receives the data from UF and fo... by Amogh88 New Member in Getting Data In 08-13-2019 0 1	0	1
Splunk UF not forwarding Data So, I've been searching for quite a while to figure out the issue on what I've been experiencing. Now at a loss I ne... by ltrand Contributor in Getting Data In 08-13-2019 1 4	1	4
props.conf not effective Hi, this issue has been mentioned here before but still my changes in props.conf are not effective. Here is the confi... by juleserror Engager in Getting Data In 08-13-2019 0 5	0	5
How to create a new field and assign the hostname field using IP address Hi All, We are getting data from an application server for all servers and we are getting the IP address in dest_ip ... by martinnepolean Explorer in Getting Data In 08-13-2019 0 3	0	3
Window Event (Multiline) nullQueue Question Hi A nullQueue procedure is need in multiline data, such as in a Windows security log. The heavy forwarder is trying ... by khyoung7410 Communicator in Getting Data In 08-12-2019 0 3	0	3
Problem replicating config (bundle) to search peer ' xx.x.xx.xx:8089 ', Unknown write error. i have a relative simple setup. One instance is an indexer, another is search head and heavy forwarder. All seems fin... by danthebiman New Member in Getting Data In 08-12-2019 0 0	0	0
how to search events within few minutes of given date time I have been looking all over and still not able to get this working. I saw few links here and still none helps. Lets... by arusoft Communicator in Getting Data In 08-12-2019 0 3	0	3
UF User Windows Hello friends! i hope you guys can help me. I have installed UF on windows server but i need to know the following: ... by julian0125 Explorer in Getting Data In 08-12-2019 0 2	0	2
indexer runs wmi queries on non-existent host We are using wmi to query windows hosts. One host being reported by the indexer does not exist. It is querying the mi... by eholz1 Builder in Getting Data In 08-12-2019 0 0	0	0
Does index clustering need to be used in order to use Smart Store? Do you have to use index clustering in order to use Smart Store? We currently have 4 standalone indexers that all UF ... by vonsolo29 Explorer in Getting Data In 08-12-2019 0 5	0	5
Cisco Apps Hello , Have you any suggestions for cisco apps to monitor events cisco routers and switches ? Ps: I installed t... by aalaa Path Finder in Getting Data In 08-12-2019 1 7	1	7
Has anyone had any success increasing queue size in the inputs.conf on the Heavy Forwarders ? We would like to increase the queue size in the inputs.conf file to test increasing the thruput to the HF's in our en... by itrimble1 Path Finder in Getting Data In 08-12-2019 0 0	0	0
How to capture user field with the windows event code 1100 We have a use case query : Detect when auditing service on any critical system was disabled, stopped or restarted mor... by swamysanjanaput Explorer in Getting Data In 08-12-2019 0 2	0	2
Unable to extract timestamp from incoming API POST I have an index cluster with load balancer a curl sending a JSON event to HEC curl http://indexers-amazonaws.com:808... by proylea Contributor in Getting Data In 08-12-2019 0 6	0	6
How to divide field value using "line break" as a delimiter I have a lookup that I try to divide using a "line break" as a delimiter. It's kind of hard to explain so I attached... by salt87 Engager in Getting Data In 08-11-2019 0 5	0	5
Eventgen Replay mode: all same timestamp Hi, Please help me out. I try to generate events with replay mode, but it is not working properly. All timestamp is ... by brandy81 Path Finder in Getting Data In 08-11-2019 0 3	0	3
TcpOutputProc SSL Error with SSL_read = 104 in Universal Forwarder We found the following message in splunkd.log in Universal Forwarder 7.0.2. The UF forwards logs to Splunk Cloud. It ... by diavolo Path Finder in Getting Data In 08-10-2019 1 3	1	3
WARN - TailReader - Could not send data to output queue (parsingQueue), retrying ??? Hello All, "WARN - TailReader - Could not send data to output queue (parsingQueue), retrying" ^ I'm seeing this mes... by Jarohnimo Builder in Getting Data In 08-10-2019 0 5	0	5
Help with source code for logging in Splunk Cloud I am trying to post logs onto Splunk cloud from .NET application. Below is the source code, please let me know if am... by venkatesanengin New Member in Getting Data In 08-09-2019 0 0	0	0
Converting Time and Date to a Uniform Value Hi, I have 3 data sources and all have different time and date formats. Field1 2019-06-07 17:05:28.513 Field2 Tue, 0... by ajdyer2000 Path Finder in Getting Data In 08-09-2019 0 3	0	3
Splunk Windows App not showing all hosts I have inherited a very old version of splunk - started with 6.2.5. I upgraded it to 7.0, which broke the Windows Inf... by eholz1 Builder in Getting Data In 08-09-2019 0 0	0	0
problems running file_meta_data app in aix 7.x Hi, I am trying to run file_meta_Data app in aix, and keep getting an exit code of 1 from introspection It runs succe... by plimpach Explorer in Getting Data In 08-09-2019 0 1	0	1
How to set a single sourcetype Max Events I have a single sourcetype that has large log files. I don't want to change the global MAX_EVENT limit, but instead, ... by shifflett46 New Member in Getting Data In 08-09-2019 0 2	0	2
What is the source of indexing lag and how to fix it? Hello, We've been having issue with license usage lately where we see sudden spike of eps from multiple host. Rece... by hcheang Path Finder in Getting Data In 08-09-2019 0 9	0	9