Getting Data In

Community Activity

How to enable rest-api? Hi Team, I'm running Splunk on AWS ec2 instance backed by AWS ALB. I've created target group for port 80,443 & 8089 ... by rajanshrivastav Path Finder in Getting Data In 09-03-2018 0 5	0	5
If I have two timestamps in my log file, how can I choose one timestamp as the timestamp of the event? I have two timestamps in my log as shown below: "#01#20180626-125301;969#19700101-000028;723#0046#01#GROUND#Y#4Y1651... by manikantakomura New Member in Getting Data In 09-03-2018 0 2	0	2
Would monitoring files with logrotate and delayed compression cause reindexing? If I'm monitoring files that are being rotated with an added timestamp, and the rotated files are being compressed af... by hettervik Builder in Getting Data In 09-03-2018 0 3	0	3
Can 6.5.2 indexers co-exist with 7.1.2 indexers? I will be upgrading 4 indexers from 6.5.2 to 7.1.2. Will I need to stop all 4 indexers, upgrade them all, and then st... by louieb3 Path Finder in Getting Data In 09-02-2018 0 5	0	5
How do I keep the Splunk CLI from disappearing in Windows so I can read the output? Hi I have two Splunk deployments, one running Splunk 7.1.0 on Windows Server 2016 and Splunk 7.1.2 on Windows 10. Whe... by behudelson Path Finder in Getting Data In 09-02-2018 1 3	1	3
Why do Summary Indexing commands help improve Splunk's performance? Hi, I have a search that will fetch about 5 GB of application logs. In order not to put load on the Splunk instance... by keishamtcs Explorer in Getting Data In 09-01-2018 0 4	0	4
How to use datamodel field values in tstats to filter resultant data? I'm trying to search my Intrusion Detection datamodel when the src_ip is a specific CIDR to limit the results but can... by DEAD_BEEF Builder in Getting Data In 08-31-2018 0 2	0	2
How to configure the timezone by sourcetype? I'm doing like this: FIELD_NAMES = DATAAREAID,RECID,DATAAREAID2,ITEMID,TRANSDATE,SUMOFQTYSEND,SUMOFQTYRET,RECIDLINE,... by renanprado96 Path Finder in Getting Data In 08-31-2018 0 12	0	12
How do I exclude log from sending to Splunk to save quota? Hi guys. I have daily quota for 3G. but the log is too much. So, I'm trying to exclude some logs, like heart beat,... by hakusama1024 New Member in Getting Data In 08-31-2018 0 3	0	3
How to detect the beginning/ending of Daylight Savings Time? I have a report in which a date/time field is converted from GMT to MST/MDT, depending on if it is currently in Dayli... by matstap Communicator in Getting Data In 08-31-2018 0 3	0	3
Field Extraction from Source Field in props.conf Hello, I am going bananas trying to figure out the error in my props.conf. All of my logs are collected using Splun... by nwaller Engager in Getting Data In 08-31-2018 0 1	0	1
Why can't my UF send data from /var/log/messages? Question: why is /var/log/messages not forwarded to index? My deployment: UF: version 7.1.2 RHEL 6.10 /opt/splunkfo... by dmpopof Engager in Getting Data In 08-31-2018 0 1	0	1
How do you collect log within 1 hour from file log rotate? Dear all, I have file log access /var/log/secure . Use log rotate ( setting daily) I need collect log login fail 3 t... by hiepdv4 New Member in Getting Data In 08-31-2018 0 1	0	1
Why is my UDP-input data appearing duplicated in the index? I've carried out two searches to find out splunk is indexing duplicate search results which are from the same host, s... by kavraja Path Finder in Getting Data In 08-31-2018 0 5	0	5
Using SPATH notation in conf files Hi guys, I need to uto extract fields and values during search time using SPATH notation in props.conf and transforms... by danielwysockiar Explorer in Getting Data In 08-31-2018 0 3	0	3
Why is Splunk not indexing in milli seconds? Hi All, I configured an input in which the timestamp field is in format 20180830112930314 (%Y%m%d%H%M%S%3N). The sam... by siva_cg Path Finder in Getting Data In 08-31-2018 0 8	0	8
This XML file does not appear to have any style information associated with it. The document tree is shown below. This XML file does not appear to have any style information associated with it. The document tree is shown below. ... by RAVIKR New Member in Getting Data In 08-31-2018 0 0	0	0
HEC: Share a basic hello world script with Ruby to send to HEC? All, I need to send some data from a Ruby script to HEC collectors. Anyone have a basic hello world script they can... by daniel333 Builder in Getting Data In 08-30-2018 0 2	0	2
Not receiving readable logs from Brocade Switches We have added brocade switches to heavy forwarder via tcp:6514. We are able to receive the logs , but not in a readab... by nairv Explorer in Getting Data In 08-30-2018 0 3	0	3
How to use blacklist in inputs.conf? Hi, How do you edit inputs.conf to blacklist some hosts from indexing and index those hosts to different index? lis... by knalla Path Finder in Getting Data In 08-30-2018 0 5	0	5
SNMP -- Correcting date/time output and rogue ap mac address Hello, I just configured an SNMP-Trap on an RHEL box to send to Splunk. Getting the following output: Agent Hostna... by jahicks New Member in Getting Data In 08-30-2018 0 0	0	0
Need help on TIME_FORMAT and TIME_PREFIX I have a props.comf that is not working for TIME_FORMAT and TIME_PREFIX for the below log structure. Trying to break ... by sathiyasun Explorer in Getting Data In 08-30-2018 0 5	0	5
How can I override sourcetype and redirect to another index? Hi Guys, I want to override sourcetype for all events before being indexed and redirect some of those events (those w... by danielwysockiar Explorer in Getting Data In 08-30-2018 2 2	2	2
Why is my Remote File & Directory input not automatically inputting data? I currently have a Remote File & Directory Data Input on the following log 'C:\Windows\System32\winevt\Logs\Microsoft... by Callumfranks Engager in Getting Data In 08-30-2018 0 2	0	2
How do you audit for who is disabling Data Input? Recently, we found one data input for receiving syslog was stopped. We don't know if the service issue is auto stop ... by kennethyeung New Member in Getting Data In 08-29-2018 0 0	0	0