Getting Data In

Community Activity

Can you forward specific data to a third-party system? I am working on a POC third-party system for some of our data and need to get data from Splunk forwarded over to it. ... by jeffbat Path Finder in Getting Data In 08-24-2018 0 3	0	3
DMC picks up incorrect server roles Hi I was in the verge of setting up the DMC console in 6.5.2 version on the Deployer. I set up the internal log forw... by saranya_fmr Communicator in Getting Data In 08-24-2018 0 16	0	16
Rename/Set Host Name We recently set up splunk to start accepting snmp logs from our switches and routers, which is working out nicely. H... by Emblibrary Explorer in Getting Data In 08-24-2018 4 7	4	7
How do I leave out timestamp from exported CVS filename (Scheduled)? Hi all, Splunk newbie here, I've searched the answers but can't find an answer... I have saved a series of searches... by johnbentley New Member in Getting Data In 08-24-2018 0 1	0	1
How Do You Forward Data to Syslog Server and Indexers? What I am trying to do is to get a particular source type forwarded from the heavy forwarder to a syslog server. In a... by rajindurbal Path Finder in Getting Data In 08-23-2018 0 3	0	3
How to enable this standalone search head(SH) to search data in a clustered SH/indexer? Hi all, I have the distributed environment setup for SH cluster and indexer cluster. Now, I have a standalone serve... by krusovice Path Finder in Getting Data In 08-23-2018 0 2	0	2
Embedded JSON column in excel looses data when imported to Splunk I am new to Splunk. I have an excel file that has a column which contains embedded JSON. When I Import the csv, I los... by sarahrdpt New Member in Getting Data In 08-23-2018 0 0	0	0
Splunk Free Edition stopped indexing after set-up I've tried browsing around previous topics but couldn't find anything that worked for my particular situation. I have... by sploited New Member in Getting Data In 08-23-2018 0 1	0	1
How to filter events on a heavy forwarder sent from universal forwarders? Hi Team, We want to drop events which contain the keyword "error" Below is our setup: universal forwarder ------>H... by thezero Path Finder in Getting Data In 08-23-2018 0 11	0	11
Inputlookup CSV two files, mapp table1 (file1) with table1 (file2) AND show the other information from file 2 in table 2,3,4.... Hi i`m new in splunk - i do not find the answer here in > answers as my list_2 do have some other account informatio... by buzek Explorer in Getting Data In 08-23-2018 0 4	0	4
Splunk Heavy Forwarder vs. PCF Firehose tile Hi, I am currently trying to decide which path to take in order to resolve a log delay issue that I am experiencing. ... by matthew_cruley New Member in Getting Data In 08-23-2018 0 0	0	0
Why is Splunk cutting off the data received with collect command? Splunk is cutting some data that is received through collect made on a server. I have already reviewed the props.con... by benhurbarbieri New Member in Getting Data In 08-23-2018 0 3	0	3
Universal forwarder - multiple inputs.conf stanzas on the same folder Hi I'm attempting to configure my universal forwarder to read log files from a single directory with multiple subdi... by Stokers_23 Explorer in Getting Data In 08-23-2018 0 3	0	3
Can I compare current data with raw data then add a new column? Hi Splunkers, Please help... I have a bunch of raw data containing my test results. My problem now is: I want t... by peiyee422 New Member in Getting Data In 08-23-2018 0 3	0	3
How to change modinputs checkpoints location Hi, We are looking to change the location of the modinputs checkpoints. By default, the checkpoints are in $SPLUNK_H... by MIJ75 Explorer in Getting Data In 08-23-2018 1 3	1	3
Heavy Forwarders as an intermediary Layer Using indexer discovery Hey, we are using multiple HF to collect data from different groups of UF before sending it to a multi site Indexer ... by ChrisLH Explorer in Getting Data In 08-23-2018 0 3	0	3
HEC Curl Command Not Working? Hello all! I have a weird problem occurring that I would like to get some feedback on. I currently am running a Splun... by thomastaylor Communicator in Getting Data In 08-22-2018 1 3	1	3
How to make the time stamp of logs default to _indextime? Hi, Is there a way to have the time stamp of logs to default to the _indextime? I have noticed that a few events from... by awedmondson Explorer in Getting Data In 08-22-2018 1 10	1	10
Perfmon:Memory missing from search head I'm trying to timechart memory usage on my search head, but for some reason it's not collecting data. Specifically, m... by dtrelford Path Finder in Getting Data In 08-22-2018 1 5	1	5
PingOne/PingIdentity log subscription ingestion - logs unreadable I am sending logs from PingOne to my heavy forwarder. The logs are being streamed to the forwarder via TCP. The logs ... by kschiemo Engager in Getting Data In 08-22-2018 0 1	0	1
Upload txt file - metafields source and sourcetype not searchable Hello, i just uploaded a txt file with some logs, through GUI Add data ->upload. Data is indexed, and I can search it... by danielwysockiar Explorer in Getting Data In 08-22-2018 0 3	0	3
crcSalt entries getting deleted on Forwarders inputs.conf, when changing Forwarder Data Inputs through GUI Hello and good afternoon. I did run into the following issue and was wondering if anybody experienced the same and/o... by ingobahn New Member in Getting Data In 08-22-2018 0 1	0	1
Support for logs compressed with xz? The version of SUSE Linux I'm using has been compressing my logs with xz (by default) rather than gzip or bzip2. As ... by hatchmt Engager in Getting Data In 08-22-2018 1 2	1	2
How can I define customize sourcetype that I write logs in _internal? My custom script writes log in /opt/splunk/var/log/splunk/script.log. I want the log to be indexed in _internal but ... by sathiyasun Explorer in Getting Data In 08-22-2018 0 2	0	2
servicesns/user/app/saved/searches endpoint doesn't filter on user or app Like the title says, I can hit the endpoint successfully, but the results are the same no matter what I replace "user... by joemaz95 Path Finder in Getting Data In 08-22-2018 0 2	0	2