Getting Data In

Community Activity

I created a OUTPUTLOOKUP and wanted to use the resulting .csv for a lookup in another search. However using lookup in the other search just doesn't return matched values. Instead, it returns all values - the lookup doesn't work. 1) \| from datamodel:"SOC_Events_SEPM" \| fields src_ip, dev_action \| search dev_action="Block" \| lookup critical_ip_... by sumitsalvi New Member in Getting Data In 10-29-2018 0 0	0	0
Indexer Cluster Replication to a specific server Hello everyone! Consider the following situation: 2 sites (A and B) 2 indexers in site A: idxa1, idxa2 2 indexers i... by chlima Explorer in Getting Data In 10-29-2018 0 0	0	0
SNMP metrics with collectd Following the documentation here https://docs.splunk.com/Documentation/Splunk/7.2.0/Metrics/GetMetricsInCollectd we'r... by mmoermans Path Finder in Getting Data In 10-29-2018 1 1	1	1
After daylight savings some timestamp errors Hi everyone! From the beginning of daylight savings, every event indexed by 1 hour, got a wrong timestamp, something... by chlima Explorer in Getting Data In 10-29-2018 0 7	0	7
Need to pull logs month wise Hi , I have 13 months of data , need to pull data month wise & year wise 24/10/2018 14:43:50.556 2018-10-24 14:43:... by rakesh43 New Member in Getting Data In 10-29-2018 0 2	0	2
How to integrate Sortspoke logs into splunk ? I am planning to ingest sortspoke logs into splunk. Can anyone guide me how to do it ? by Suparna123 Engager in Getting Data In 10-29-2018 0 2	0	2
Time difference between first and last events of a search Hello, I would like to know if and how is it possible to find and put in a field the difference (in time: seconds, ho... by cafissimo Communicator in Getting Data In 10-29-2018 4 8	4	8
Biztalk log ingestion I want to know what type logs can i fetch from Biztalk , I want to ingest Biztalk logs into splunk by Abhirup89 Explorer in Getting Data In 10-28-2018 0 2	0	2
Scheduling a saved search to run every 30 minutes, how do I get results from the previous run instead of dispatching the search each time a user visits the page? Hi All, I have 3 saved searches set up to run every 30 mins. These searches run fine and the data gets created witho... by ks2211 Engager in Getting Data In 10-28-2018 0 3	0	3
Index alert excessive growth We are having problem with some of our indexes growing rapidly. I am trying to figure out a search/alert that have a ... by Emiskowi New Member in Getting Data In 10-28-2018 0 1	0	1
How would you use Transform.conf to filter an index into a sub-index? Hi. Apologies if it's been asked before but is there some guide on how to use the props.conf or transform.conf to f... by DontStopNowBaby Explorer in Getting Data In 10-27-2018 0 1	0	1
How can I collect (and/or parse) data without indexing? Hi, I would like to collect (and parse) data/logs without indexing them as they don't need to be searched with Splunk... by OLWI New Member in Getting Data In 10-27-2018 0 15	0	15
Can you distribute an Http Event Collector (HEC) without restarting? Hi, I use to share my HEC tokens with the index cluster via deployment server. When I create the new token into Clus... by freaklin Path Finder in Getting Data In 10-27-2018 0 1	0	1
search for logins to splunk itself I need a search that can show me who is logging into our splunk instance itself. Not monitor logins to systems that a... by Sean Engager in Getting Data In 10-26-2018 2 3	2	3
Recommended way to consume Active Batch logs? I want to consume log files generated by jobs running under Active Batch. I'm pretty new to splunk. What would be the... by zsimic Path Finder in Getting Data In 10-26-2018 0 4	0	4
Disk partition contains that frozen bucket data is not showed on DMC disk usage. My splunk installed in / partition. But frozen bucket data is in /data partition. So, I want to see both of disk usa... by yutaka1005 Builder in Getting Data In 10-26-2018 0 1	0	1
Why is my inputlookup table not working? I wanted to ask you for some help. I am trying to create a lookup table on Splunk. I can’t make it work and I can't f... by albin111 New Member in Getting Data In 10-25-2018 0 9	0	9
Why am I unable to connect to Splunk cloud from universal forwarder? I have installed the universal forwarder according to http://docs.splunk.com/Documentation/SplunkCloud/7.0.5/User/F... by yantriks Engager in Getting Data In 10-25-2018 0 1	0	1
How do I search multiple source types based on a lookup file? Is there a way to search events from multiple source types when the list of source types is available in a lookup fil... by tusharsaran1 Path Finder in Getting Data In 10-25-2018 0 2	0	2
How do you extract fields from IIS logs? Good morning. I have to set up my universal forwarder to capture IIS logs. The problem is the fields are not extrac... by davidblizzard Explorer in Getting Data In 10-25-2018 0 1	0	1
How do you Ingest data from Bitbucket repositories to Splunk? Hello, I have been tasked to make a Splunk dashboard that shows reports from Bitbucket pull requests, branches, com... by davidblj Explorer in Getting Data In 10-25-2018 0 2	0	2
Need suggestions troubleshooting periodic dropping of logs from a forwarder. On indexer "Local side shutting down" I've got a metrics alert that runs every hour and sends me an email when the volume in my dhcp index is over a certai... by wrangler2x Motivator in Getting Data In 10-25-2018 0 4	0	4
What does the heartbeatFrequency setting do in outputs.conf? What does it actually mean and what are its use cases? Is this different from autoLfrequency? From Docs, I can infer ... by splunkn Communicator in Getting Data In 10-25-2018 0 2	0	2
props.conf hostname with hyphen We are able to match entries in props.conf using the hostname... unless that hostname has a hyphen. Then, for whatev... by carlosumbc Loves-to-Learn Lots in Getting Data In 10-25-2018 0 2	0	2
Splunk Java Logging - Logging to two TCP ports at the same time I have a requirement where i need to send some audit logs to one index and server logs to another, i have two tcp po... by sivavelicheti New Member in Getting Data In 10-24-2018 0 0	0	0