Getting Data In

Community Activity

Splunk build (SPLUNK_BUILD) for 7.1.2. I I'd need to run a custom docker build and it required the build hash to grab the release. Thanks. by wolstena New Member in Getting Data In 04-03-2019 0 0	0	0
Can anyone tell me where the "Destination app" can be set for a source type? Can anyone tell me where the "Destination app" can be set for a SourceType? When we try to change it in the GUI, we g... by RDAVISS Path Finder in Getting Data In 04-03-2019 0 0	0	0
Error while searching using the value from the input I have the following dynamic options for my "consumer" multiselect: index=$index$ \| fillnull value="not specified" ... by quintessence New Member in Getting Data In 04-03-2019 0 1	0	1
How to filter data by multiselect I'm trying to use multiselect for filtering my charts data: search "msg.mdc.headers.consumer{}"=$consumer$ , where... by quintessence New Member in Getting Data In 04-03-2019 0 1	0	1
Storing the SPLUNK logs on hard disks (different from C partition) Hi, I'v just installed the physical server and the SPLUNK application. Windows Server 2008 R2 (x64 - SPLUNK). On thi... by twieczorkowski Explorer in Getting Data In 04-03-2019 0 3	0	3
Line breaking not working with rolling log files Log file name : run_xxxxxxx_XXX_XXXXXX_XXX.log.04020830 This is the log file name and its suffix always ends with cu... by bishtk Communicator in Getting Data In 04-03-2019 0 3	0	3
Splunk mongod upgrade Our Security and Network team want to Upgrade Splunk MongoD due to vulnerability cases. in my own knowledge: Mongod a... by jadengoho Builder in Getting Data In 04-03-2019 0 1	0	1
Can you help me with an issue when adding a second indexer? one Search head / one indexer system — try to add a second indexer. After I added the second indexer, in the search ... by xindeNokia Path Finder in Getting Data In 04-02-2019 0 2	0	2
Is there an SPL command using REST to list the macros contained within a macro? Hello, I see that we can use SPL to get a list of arguments, "args", of a macro using the "rest" command. \| rest /se... by kdwsplunk Explorer in Getting Data In 04-02-2019 1 4	1	4
How do you configure props.conf for multiline events? Hi fellow Splunkers! Having issues configuring props.conf for sourcing data to Splunk. We have now spent a couple of... by emilbach New Member in Getting Data In 04-02-2019 0 8	0	8
DATETIME_CONFIG issue Im trying to base the timestamp in the logs on the current time using DATETIME_CONFIG = CURRENT in props.conf rather ... by Dark_Ichigo Builder in Getting Data In 04-02-2019 0 9	0	9
How do you process Websocket data in Splunk? I have a program logging out responses from a websocket endpoint to a file. I want to be able to get this data into S... by tolaram Engager in Getting Data In 04-01-2019 1 0	1	0
java verbosegc log files (long pause before log line flushes) We are trying to forward verbose Java garbage collection log files (java version "1.6.0_34") using Java's "-XX:+Print... by pmacdougall Explorer in Getting Data In 04-01-2019 4 6	4	6
Metric value= is not valid Metric event data with an invalid metric value would not be indexed. Ensure the input metric data is not malformed. Hi, I've integrated collectd metrics with Splunk 6.x via HEC in the past but getting some issues recently with coll... by smitra_splunk Splunk Employee in Getting Data In 04-01-2019 2 2	2	2
Can you help props.conf to break the event and mask the data? I have the below sample event {"timestamp": 1553559218742, "message": "(0133108c-4f5c-11e9-82ca-1b5bad0211a1) Method... by vrmandadi Builder in Getting Data In 04-01-2019 0 1	0	1
Is there any way to manage/perform actions on AD objects from Splunk? Is there any way to make changes to AD objects from Splunk? Like unlocking an account or changing passwords? My Splu... by alonsocaio Contributor in Getting Data In 04-01-2019 0 0	0	0
Data Truncated for 1194646 value, where i couldn't use TRUNCATE=0 or TRUNCATE=1194646 in my props What is the best way to get my all the data of a single lined of length 1194646 into splunk ? My data starts with : ... by sandeepreddy947 Path Finder in Getting Data In 04-01-2019 0 6	0	6
How to migrate complete splunk instances to new servers Currently, I have the following servers in my splunk environment, due to resource utilization we need to migrate/move... by hadiamro Engager in Getting Data In 04-01-2019 0 1	0	1
Custom alerts logs don't appear in internal index I don't see my custom alert action's logs as the documentation suggests I should. import sys # splat # Run with arb... by diletoan Explorer in Getting Data In 04-01-2019 0 3	0	3
Can you help us with our SNOW/Splunk Integration? We are doing things different than how things are normally configured for the integration between SNOW and Splunk. W... by amorgan_splunk Splunk Employee in Getting Data In 04-01-2019 1 1	1	1
How can I obtain and use a UF's clientIP in transforms.conf on a HF? A customer has a case where they are cloning a subset of UF logs to an external third party using an intermediate HF ... by thilles Explorer in Getting Data In 04-01-2019 0 1	0	1
how to create the checkpoint file for scripted input. Hi Folks, we have created the script with multiple REST API and able to fetch the results from endpoint but we are ... by sridharlakshman New Member in Getting Data In 04-01-2019 0 0	0	0
How do you run a script on a forwarder as a part of an alert action? Hi, I'm writing an integration for one of our security solutions. I'm implementing an alert action, and I want the ... by chenShafir Engager in Getting Data In 04-01-2019 0 2	0	2
How do you check where an index is being sent to on an IIS Box ? We have this on /etc/system/local for testing Inputs.conf file [default] host = server name goes here [monitor://... by itrimble1 Path Finder in Getting Data In 03-31-2019 0 5	0	5
splunk forwarder to splunk cloud trail version Hi All, Am trying to send data to splunk cloud trail version with the help of Universal forwarder.i followed with th... by harishalipaka Motivator in Getting Data In 03-30-2019 1 0	1	0