Getting Data In

Community Activity

Is Splunk Universal Forwarder able to run Powershell inputs? In Inputs.conf, it says that we can run powershell scripts using the below stanza. Does the universal forwarder have ... by ankithreddy777 Contributor in Getting Data In 12-10-2018 0 1	0	1
How come my regexes aren't working in props source matching? Splunk Enterprise 6.5.4, with dedicated indexer and search head clusters, using config such as this: transforms.conf... by krisreeves Path Finder in Getting Data In 12-10-2018 1 5	1	5
What do I do if the Splunk DB Connect database connection is invalid due to the server time zone value being unrecognized? Splunk DB connect database connection is invalid due to the server time zone value being unrecognized. What do I do? by rsantoso_splunk Splunk Employee in Getting Data In 12-10-2018 0 1	0	1
What do we need to write in TIME_FORMAT in props.conft to extract a timestamp? How do you extract a timestamp in an event like this "2018-12-05T00:31:03.711Z"? Like, what do we need to write in T... by vishaltaneja070 Motivator in Getting Data In 12-10-2018 0 6	0	6
Can I run the btool command on a universal forwarder without running shell or powershell script? I would like to run a scheduled Splunk btool command using scripted input to index configs every few hours. I cannot ... by ankithreddy777 Contributor in Getting Data In 12-10-2018 0 14	0	14
Can you help me set up our heavy forwarder for the following event filtering necessities? Hello, Can someone please direct me to the Splunk docs tutorial, or any video, that would show me how to use the hea... by farooqm New Member in Getting Data In 12-10-2018 0 1	0	1
Why can't I blacklist Windows Security EventCode 5152 in inputs.conf? Hello, I am trying to blacklist EventCode 5152 in inputs.conf. I have tried putting it in a different order in the ... by bwaldren Explorer in Getting Data In 12-10-2018 1 15	1	15
How do you filter results after using the tostring "duration"? I used the answer from this thread to create my query, but I can't figure out how to narrow them down. https://answer... by pmhelfrich Explorer in Getting Data In 12-10-2018 0 2	0	2
Why is my regex in transforms.conf for source in props.conf not working for one of three Indexers? I'm trying to use a regex in a transforms.conf file on the Indexer to prevent indexing of informational and debug mes... by teedilo Path Finder in Getting Data In 12-10-2018 0 14	0	14
How can I split my data to show the average based on column values? I am using the following query to split my data to show the average, min, and max based on the fields. But, I seem to... by angersleek Path Finder in Getting Data In 12-10-2018 0 2	0	2
How does the deployment client decide which ipv4 address (of possibly multiple) to present when phoning home? The other day I came across universal forwarder based deployment client which was not receiving deployment server app... by dstaulcu Builder in Getting Data In 12-10-2018 0 2	0	2
File can't be indexed Hi Team, I have on file (is the picture) that are unable to catch and index i have this configuration in my input... by serviceinfrastr Explorer in Getting Data In 12-10-2018 0 11	0	11
How do I make my heavy forwarder, which is already configured, into a deployment server? I have a Splunk Cloud instance and a heavy forwarder that sends in all my data into my cloud instance. I will now be ... by kdelvillar Engager in Getting Data In 12-10-2018 0 3	0	3
custom fields are not returned in search/jobs end point Hi, The custom fields set in search/jobs POST are not returned in search/jobs GET. In earlier versions of splunk the... by strive Influencer in Getting Data In 12-10-2018 0 1	0	1
Can you help me get multiple fields from a single field in JSON? The text field in my event contains A LOT of data. json snipped : {"Date":"2018-12-05T12:04:04.71","ID":"00000000-0... by danw25 Engager in Getting Data In 12-10-2018 0 3	0	3
Why am I getting the following error from the LineBreakingProcessor: "Truncating line because limit of 10000 bytes has been exceeded?" Hi Team, I am using Splunk 7.1.1 and i have been getting this error constantly LineBreakingProcessor - Truncating ... by swaroopbr Engager in Getting Data In 12-09-2018 0 3	0	3
override source field to a common source using transform.conf and props.conf Hi I want to have a common source field for all my syslog. I have centralized syslog server where I am running splun... by meet_vadaria Engager in Getting Data In 12-07-2018 0 5	0	5
How can I take multiple fields and time values and combine them into one? Suppose I have 4 fields fields= "jobtype" values= A,B fields= "status" values=1,2,3,4,5,6 fields= "Time1" ... by hyungjoon New Member in Getting Data In 12-07-2018 0 1	0	1
How to send few values from jenkins pipeline to splunk and report it Hi, Thanks in advance for your help. I am new to splunk and working on building few reports in splunk from Jenkins.... by sendilprakash Explorer in Getting Data In 12-07-2018 0 1	0	1
Why is my bash scripted input failing on Ubuntu while it's OK on other distros? Hello, I have an issue with a scripted input. I have 2 Linux on Amazon Web Services (AWS) : 1 based one AWS Linux ... by D2SI Communicator in Getting Data In 12-07-2018 1 7	1	7
Can you help me create a search that would monitor activity to our login page from a single URL? Hi Team, I hope that we are all well? I'm working on a search to assist in monitoring one of our web portals. We'd... by MikeElliott Communicator in Getting Data In 12-07-2018 0 4	0	4
How to use the universal forwarder to parse log files with a key value pair format and forward to splunk cloud Hello, I'm trying to parse log entries that look like so EventTime=2018-12-07 10:06:31,Hostname=WIN-UE7JIIAK3IG.nx... by cameronharris6 New Member in Getting Data In 12-07-2018 0 1	0	1
Why is host override in inputs.conf not working when it's IP? I have remote servers dropping logs to a syslog server where I have a Splunk forwarder configured to push it to Splun... by meet_vadaria Engager in Getting Data In 12-07-2018 0 4	0	4
How come replication isn't working on the Index cluster after a reboot? We had to shut down one of the machines and create a new one. The cluster replication between the new and old ones do... by christopherr_sp Splunk Employee in Getting Data In 12-07-2018 1 1	1	1
Lookup: local_ip{ having fields threat_key, CIDR range, description}. I want to match ip from index=* to the column CIDR range of lookup where threat_key="abc". How we can do that Lookup: local_ip{ having fields threat_key, CIDR range, description}. I want to match ip from index=* to the column C... by shaif95 New Member in Getting Data In 12-07-2018 0 3	0	3

Get Updates on the Splunk Community!

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

July Community Events: Master ITSI 5.0 & Automate Splunk

Struggling with alert fatigue or feeling like you're spending more time on infrastructure maintenance than ...

New Release of Federated Search: Bringing Splunk Analytics to More of Your Data

Organizations today are generating more data than ever and storing it across cloud object stores, data lakes, ...

Getting Data In

Is Splunk Universal Forwarder able to run Powershell inputs?

How come my regexes aren't working in props source matching?

What do I do if the Splunk DB Connect database connection is invalid due to the server time zone value being unrecognized?

What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?

Can I run the btool command on a universal forwarder without running shell or powershell script?

Can you help me set up our heavy forwarder for the following event filtering necessities?

Why can't I blacklist Windows Security EventCode 5152 in inputs.conf?

How do you filter results after using the tostring "duration"?

Why is my regex in transforms.conf for source in props.conf not working for one of three Indexers?

How can I split my data to show the average based on column values?

How does the deployment client decide which ipv4 address (of possibly multiple) to present when phoning home?

File can't be indexed

How do I make my heavy forwarder, which is already configured, into a deployment server?

custom fields are not returned in search/jobs end point

Can you help me get multiple fields from a single field in JSON?

Why am I getting the following error from the LineBreakingProcessor: "Truncating line because limit of 10000 bytes has been exceeded?"

override source field to a common source using transform.conf and props.conf

How can I take multiple fields and time values and combine them into one?

How to send few values from jenkins pipeline to splunk and report it

Why is my bash scripted input failing on Ubuntu while it's OK on other distros?

Can you help me create a search that would monitor activity to our login page from a single URL?

How to use the universal forwarder to parse log files with a key value pair format and forward to splunk cloud

Why is host override in inputs.conf not working when it's IP?

How come replication isn't working on the Index cluster after a reboot?

Lookup: local_ip{ having fields threat_key, CIDR range, description}. I want to match ip from index=* to the column CIDR range of lookup where threat_key="abc". How we can do that

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

July Community Events: Master ITSI 5.0 & Automate Splunk

New Release of Federated Search: Bringing Splunk Analytics to More of Your Data

How do I go about the integration with Global Rela...

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

How to integrate threat armor with splunk?

Getting Data In

Join the Conversation