Getting Data In

Community Activity

feed Splunk App for Windows Infrastructure without forwarders? I have a situation where management wants to see server status of some remote deployed servers, but due mostly to pol... by DaClyde Contributor in Getting Data In 07-31-2019 0 1	0	1
mask anonymize data by role Is there a way to mask or anonymize data in splunk by role such that one role (such as Admin) can see all the data o... by amitosr Explorer in Getting Data In 07-31-2019 1 5	1	5
Can you help me split a JSON event with regex in props.conf? Hi guru's: i have JSON data that looks like the below. { "BOMxmlDlTime": 0.6584670543670654, "TODAY-PLUS... by keiran_harris Path Finder in Getting Data In 07-31-2019 0 5	0	5
Does Splunk Universal Forwarder forward audit events Does Splunk Universal Forwarder forward audit event logs to Splunk _audit index? I can see Splunk HF's are forwarding... by ankithreddy777 Contributor in Getting Data In 07-31-2019 0 3	0	3
Active Directory not send logs for Splunk Hello, I am using splunk enterprise on linux server. I want to monitor active directory logs. I installed the univer... by mlog New Member in Getting Data In 07-31-2019 0 3	0	3
I want to take input from forwarder but before that I want to run python script I want to take input from forwarder but before that I want to run python script, just like in enterprise we can add d... by yashjain12yj New Member in Getting Data In 07-31-2019 0 3	0	3
Change hostname Hello All, I have several devices on our network that has one interface/IP address in our DMZ and a management IP ad... by edwardrose Contributor in Getting Data In 07-31-2019 0 10	0	10
Running into errors while disabling the legacy ciphers in splunk 7.2 I am trying to follow the document to disable the legacy ciphers in the Splunk 7.2, and I notice that the cluster mas... by vinkumar_splunk Splunk Employee in Getting Data In 07-31-2019 0 2	0	2
Xml logs event separation Hi. I have 10000 xml log output. like : {LOG DATE.../DATE TIME.../TIME CC.../CC AMOUNT.../AMOUNT ... by volkanyilmaz New Member in Getting Data In 07-31-2019 0 1	0	1
LDAP pre-cache If we have multiple users in our organization and do these users expire from the LDAP pre-cache? by swmishra_splunk Splunk Employee in Getting Data In 07-31-2019 0 1	0	1
How to configure a sourcetype for JSON data to parse each line as a distinct event? I have an application that logs out single line JSON statements. For some reason when I load this into Splunk, most o... by rfitch Path Finder in Getting Data In 07-30-2019 2 5	2	5
How to populate Meaningful form of data Hi Guys, Can you please help me, in framing a query. Like i have this kind of data structure: clk_ctrl: { [-] ... by Maniteja81 New Member in Getting Data In 07-30-2019 0 1	0	1
How do I create a report that can run automatically only when the indexer performs indexing after receiving an input file from forwarder instead of the scheduling with given fixed time ? How do I create a report that can run automatically only when the indexer performs indexing after receiving an input ... by vinaybandaru Path Finder in Getting Data In 07-30-2019 0 2	0	2
When trying to set up a distributed system, can you help me with the following error?: "Unable to distribute to peer, peer has status=2" distributed system. splunk 7.1.2 one SH + one indexer In the SH splunkd log: DistributedPeerManager - Distributed:... by xindeNokia Path Finder in Getting Data In 07-30-2019 4 4	4	4
What should the indexer queues be? After filling the tiny queues on the indexers, we would like to move to bigger queues. We are thinking about the fo... by danielbb Motivator in Getting Data In 07-30-2019 0 1	0	1
How do I see all Hosts? It's only showing "Top 10 Values" for some reason. by philrego Path Finder in Getting Data In 07-30-2019 0 7	0	7
How to debug why a universal forwarder is parsing files from paths but no data is ingested? Hi Everyone, I am trying to monitor xml files from a directory in a certain server. But for some unknown reason/s no... by jvmerilla Path Finder in Getting Data In 07-30-2019 0 4	0	4
Multiple Splunk indexer with same $SPLUNK_DB location Hi, I have $SPLUNK_DB set up in a NAS storage. But the indexer is installed in a VM (say VM1) running on splunk versi... by sujoybose77 Explorer in Getting Data In 07-29-2019 0 3	0	3
Splunkd Warning: "C:\program files\...\local.meta already exists but with different casing: C:\Program Files\...\local.meta" Hello fellow Splunkers, We've been tracking down and resolving our Splunkd errors and warnings. This one has us perp... by jacobpevans Motivator in Getting Data In 07-29-2019 1 1	1	1
How to find the Active Directory and ingest data from it? Trying to get data from the AD data from the forwarder to Domain Controller. Could not see any settings within Splun... by keldridg2 New Member in Getting Data In 07-29-2019 0 3	0	3
Splunk is pulling the wrong custom .conf file I have two apps that are both utilizing the same exact type of custom .conf file. The data in the .conf files are sup... by vanixishere New Member in Getting Data In 07-29-2019 0 1	0	1
JSON Split at Index Time Hi all, I have a JSON file output from a RESTful API service and the log looks something like this: {<!-- --> "Provider":... by krishnakesiraju Explorer in Getting Data In 07-29-2019 0 1	0	1
Allow only a specified SSL cipher in the splunk forwarder? Hello, our Nessus scanner show a issue with the 56 bit SSL ciphers which are allowed by the splunk forwarder: Syno... by BastianW Path Finder in Getting Data In 07-29-2019 0 5	0	5
Limitation of using Forwarder license Hi I have read splunk docs https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/TypesofSplunklicenses I want to ... by ips_mandar Builder in Getting Data In 07-29-2019 0 2	0	2
Event breaking not working properly with the regex ([\r\n]+) Event breaking not working properly with the below regex... props.conf LINE_BREAKER=([\r\n]+) My Log data : ('Hi-S... by soumdey Path Finder in Getting Data In 07-29-2019 0 9	0	9