Getting Data In

Community Activity

AD FS - event ID 1102 Hello, I have encountered a problem with AD FS events that has the ID 1102. They are getting the action "cleared", ... by astatrial Contributor in Getting Data In 04-04-2019 0 3	0	3
Will Outputs.conf reflect the timestamp parameters? Hello Splunkers, I have outputs.conf in my Universal Forwarder at \etc\system\local\ , I am monitoring some log file... by sarvesh_11 Communicator in Getting Data In 04-04-2019 0 1	0	1
Issue with monitoring one specific log file Hi, I am monitoring multiple files/directory under different sourcetype. For one specific log file I am getting wie... by AKG1_old1 Builder in Getting Data In 04-04-2019 0 7	0	7
Why am I unable to set sourcetype in props.conf? I have a syslog feed sending me firewall data from a linux system. It calls that sourcetype syslog, of course. I'm f... by Michael Contributor in Getting Data In 04-04-2019 0 8	0	8
How does Splunk connect to the Universal forwarders — using IP or HostNames? Can anyone clarify if Splunk Deployment server and Indexer connects to Universal forwarder using hostname or IP addre... by arrangineni Path Finder in Getting Data In 04-03-2019 0 2	0	2
How to filter out data after specific event? Hi, I'm trying to filter out data after a specific event occurs. I want to drop all of the search data to display... by haph Path Finder in Getting Data In 04-03-2019 0 2	0	2
Syslog data to new Splunk instance I've recently inherited an old Splunk installation, and I'm in the process of migrating it over to a new updated inst... by bobmc859 New Member in Getting Data In 04-03-2019 0 13	0	13
Splunk build (SPLUNK_BUILD) for 7.1.2. I I'd need to run a custom docker build and it required the build hash to grab the release. Thanks. by wolstena New Member in Getting Data In 04-03-2019 0 0	0	0
Can anyone tell me where the "Destination app" can be set for a source type? Can anyone tell me where the "Destination app" can be set for a SourceType? When we try to change it in the GUI, we g... by RDAVISS Path Finder in Getting Data In 04-03-2019 0 0	0	0
Error while searching using the value from the input I have the following dynamic options for my "consumer" multiselect: index=$index$ \| fillnull value="not specified" ... by quintessence New Member in Getting Data In 04-03-2019 0 1	0	1
How to filter data by multiselect I'm trying to use multiselect for filtering my charts data: search "msg.mdc.headers.consumer{}"=$consumer$ , where... by quintessence New Member in Getting Data In 04-03-2019 0 1	0	1
Storing the SPLUNK logs on hard disks (different from C partition) Hi, I'v just installed the physical server and the SPLUNK application. Windows Server 2008 R2 (x64 - SPLUNK). On thi... by twieczorkowski Explorer in Getting Data In 04-03-2019 0 3	0	3
Line breaking not working with rolling log files Log file name : run_xxxxxxx_XXX_XXXXXX_XXX.log.04020830 This is the log file name and its suffix always ends with cu... by bishtk Communicator in Getting Data In 04-03-2019 0 3	0	3
Splunk mongod upgrade Our Security and Network team want to Upgrade Splunk MongoD due to vulnerability cases. in my own knowledge: Mongod a... by jadengoho Builder in Getting Data In 04-03-2019 0 1	0	1
Can you help me with an issue when adding a second indexer? one Search head / one indexer system — try to add a second indexer. After I added the second indexer, in the search ... by xindeNokia Path Finder in Getting Data In 04-02-2019 0 2	0	2
Is there an SPL command using REST to list the macros contained within a macro? Hello, I see that we can use SPL to get a list of arguments, "args", of a macro using the "rest" command. \| rest /se... by kdwsplunk Explorer in Getting Data In 04-02-2019 1 4	1	4
How do you configure props.conf for multiline events? Hi fellow Splunkers! Having issues configuring props.conf for sourcing data to Splunk. We have now spent a couple of... by emilbach New Member in Getting Data In 04-02-2019 0 8	0	8
DATETIME_CONFIG issue Im trying to base the timestamp in the logs on the current time using DATETIME_CONFIG = CURRENT in props.conf rather ... by Dark_Ichigo Builder in Getting Data In 04-02-2019 0 9	0	9
How do you process Websocket data in Splunk? I have a program logging out responses from a websocket endpoint to a file. I want to be able to get this data into S... by tolaram Engager in Getting Data In 04-01-2019 1 0	1	0
java verbosegc log files (long pause before log line flushes) We are trying to forward verbose Java garbage collection log files (java version "1.6.0_34") using Java's "-XX:+Print... by pmacdougall Explorer in Getting Data In 04-01-2019 4 6	4	6
Metric value= is not valid Metric event data with an invalid metric value would not be indexed. Ensure the input metric data is not malformed. Hi, I've integrated collectd metrics with Splunk 6.x via HEC in the past but getting some issues recently with coll... by smitra_splunk Splunk Employee in Getting Data In 04-01-2019 2 2	2	2
Can you help props.conf to break the event and mask the data? I have the below sample event {"timestamp": 1553559218742, "message": "(0133108c-4f5c-11e9-82ca-1b5bad0211a1) Method... by vrmandadi Builder in Getting Data In 04-01-2019 0 1	0	1
Is there any way to manage/perform actions on AD objects from Splunk? Is there any way to make changes to AD objects from Splunk? Like unlocking an account or changing passwords? My Splu... by alonsocaio Contributor in Getting Data In 04-01-2019 0 0	0	0
Data Truncated for 1194646 value, where i couldn't use TRUNCATE=0 or TRUNCATE=1194646 in my props What is the best way to get my all the data of a single lined of length 1194646 into splunk ? My data starts with : ... by sandeepreddy947 Path Finder in Getting Data In 04-01-2019 0 6	0	6
How to migrate complete splunk instances to new servers Currently, I have the following servers in my splunk environment, due to resource utilization we need to migrate/move... by hadiamro Engager in Getting Data In 04-01-2019 0 1	0	1