Getting Data In

Community Activity

Is there a potential data loss with UDP? We are forced to use UDP (and not TCP) for one client and we wonder how much data loss we might expect with UDP. Any... by ddrillic Ultra Champion in Getting Data In 01-18-2019 0 4	0	4
Need help: why my search head is not using the settings in transforms.conf I am migrating from a stand-alone Splunk instance to a Splunk cluster (w/ search-head-cluster + indexer-cluster) and ... by patng_nw Communicator in Getting Data In 01-18-2019 0 6	0	6
Can you help me figure out why some files were not sent to the Heavy forwarder? The universal forwarder (UF) seems to read the following files, but the files were not sent to the heavy forwarder (H... by kinaba_splunk Splunk Employee in Getting Data In 01-18-2019 0 1	0	1
Testing Splunk UF config on Windows, with Inspec. Hi, I have 2 installations of Splunk. One on a Linux image, one on a Windows 2016 image - both on AWS. I am testing... by northernstar002 New Member in Getting Data In 01-18-2019 0 0	0	0
Search head is not communicating with its peer(Indexer) Error [00000080] Instance name "XXX.XXX.XXX.XXX:8089" REST interface to peer is taking longer than 5 seconds to respo... by ashishlal82 Explorer in Getting Data In 01-18-2019 0 5	0	5
Universal Forwarderが全てのWindows Security Event Logを送付できてない WindowsドメインコントローラにインストールされたUniversal Forwarder ( UF ) は Windows Security Event Log しか監視していないが、全ての Event Log を Indexer... by cweiliou_splunk Splunk Employee in Getting Data In 01-18-2019 0 1	0	1
Universal ForwarderのCPU使用率を下げる方法について WindowsサーバにインストールされたUniversal Forwarder ( UF ) が時々20%くらいまでCPUを使用してしまいます。常に20%ではなく、急に20%まで上昇し、そして、何分後にまた3, 4%まで下がりますが... by cweiliou_splunk Splunk Employee in Getting Data In 01-18-2019 0 1	0	1
Extract both general and xml contents from Windows Event log Hello all, I have UF installed in Windows servers to collect event. inside the inputs.conf there is only option to tu... by Cbr1sg Path Finder in Getting Data In 01-17-2019 0 0	0	0
How to configure Splunk docker container I want to know the steps on setting up Splunk in Docker container by mbagali_splunk Splunk Employee in Getting Data In 01-17-2019 0 1	0	1
How do I exclude stream events based on criteria before indexing? Hi All, I require to exclude events when the 'dest_port=80'. I have gone through other similar examples and have com... by lznger88_2 Path Finder in Getting Data In 01-17-2019 0 4	0	4
Folder creation in /opt/splunk/ directory. Hi, Can we create a custom folder in /opt/splunk/etc/ directory. Will that affect any functionality of Splunk ? Bas... by nawazns5038 Builder in Getting Data In 01-17-2019 0 1	0	1
Why is the Http event collector not visible in UI? Hi, Splunk version : 6.6.1 Http event collector not visible in UI, we are not able to find it under data inputs. A... by ArunSudarsanam1 Explorer in Getting Data In 01-17-2019 2 5	2	5
Can I turn off the data is too_small sourcetype behavior? I have a set of log files that when they contain greater than 99 events have rules defined in the props.conf to prope... by marksedam New Member in Getting Data In 01-17-2019 0 10	0	10
no line breaks in CSV log file using splunk 7.2.1 hello, Im ingesting an iotop I/O log thats in a csv format (using forwarder to send log to indexe... by qbadmin New Member in Getting Data In 01-17-2019 0 7	0	7
How to connect to external lookup using Python script? We were using below script to connect and download csv and store it in folder. But now website has changed and it ask... by nnimbe1 Path Finder in Getting Data In 01-17-2019 0 1	0	1
How come only some data is replicating? Hey there, I have one search head (SH), one Indexer, and one DS in my Splunk 7.2 environment. For months, the SH has... by nick405060 Motivator in Getting Data In 01-17-2019 0 4	0	4
Reset token from tokens.py in splunk REST app I need some help, I am using version 1.5.3 of the splunk Rest App, how can I reset the tokens.py ?, in the url of my ... by joseag New Member in Getting Data In 01-17-2019 0 0	0	0
Read logs from Microsoft-Windows-Windows Defender/Operational Hello, I am trying to read from events logs namely {Microsoft-Windows-Windows Defender/Operational}. From Manager>Da... by irshadrahimbux New Member in Getting Data In 01-17-2019 0 11	0	11
Integration between Azure Data Lake and Splunk Hi all, Am wondering if anyone has tried this integration before? From my research, we can ingest audit and diagnost... by btanjialih Explorer in Getting Data In 01-17-2019 2 0	2	0
Why is Splunk indexing data for 12 hours instead of 24 hours? After 12:59 PM slpunk is indexing data to 1:AM. It should index data for 24 hours but it is indexing for 12 hours onl... by gautamr103 New Member in Getting Data In 01-16-2019 0 7	0	7
Would like to block a specific Source going to a Heavy Forwarder Hello Community, Resources: - Splunk Enterprise On-Prem = v7.1.2 - F5-BIGIP = v13.1.0 - Using: F5 Analytics iApp v... by evolutionxtinct Explorer in Getting Data In 01-16-2019 1 2	1	2
LINE_BREAKER not working with most basic settings I have a json blob, lets ignore the fact it is json for now. I simply want to force Splunk to break a single blob on... by Cuyose Builder in Getting Data In 01-16-2019 0 4	0	4
REGEX works in search but not as a field extraction. Hi, I am trying to extract a value from one of the existing fields. REGEX works fine when used with "rex" directly o... by att35 Builder in Getting Data In 01-16-2019 0 9	0	9
How to write the input monitor stanza for the Postgre sql and shell scipt data 1 /var/lib/pgsql/dump_subscription_info 2. /root/scripts/tablespace.sh. 3. /home/infovista/DiskCPUMemory_Utilization_iV.sh how to write input monitor stanza for Shell script and postgresql data transferred to splunk? by Pranayreddy84 New Member in Getting Data In 01-16-2019 0 0	0	0
Certificate Renewal Process Hello All, We are planning to renew certificates for our universal forwarders with pre 6.3 version, and all these fo... by bharathkumarnec Contributor in Getting Data In 01-16-2019 0 2	0	2