Getting Data In

Community Activity

Can splunk read data from unix stream socket? Is it possible to get data in splunk from unix stream socket? Not tcp\udp socket, but socket like this - https://en.w... by gots Path Finder in Getting Data In 07-18-2018 0 7	0	7
SEDCMD vs TRANSFORMS? 1) When to use SEDCMD? 2) When to use transforms and props for data masking? 3) Which is better? by patricianaguit Explorer in Getting Data In 07-18-2018 0 2	0	2
How can I propagate date+hour to each next event in the log? Hi. I am a newborn splunk user. Logs come in the following format --Format-- @@dd/mm/yyyy_HH MMSS.msecond\|Message... ... by Pharaon Engager in Getting Data In 07-18-2018 0 2	0	2
How to get the xml data into splunk from the https url i have the https url and how to pull the xml data using the url from Splunk. Below is the sample url https://10.10... by Nadhiyaa Path Finder in Getting Data In 07-18-2018 0 2	0	2
Is there a REST API call to rebuild the forwarder asset table? Is there an API call that can rebuild the forwarder asset table as opposed to going into the Distributed Management C... by sarahkrisher New Member in Getting Data In 07-17-2018 0 2	0	2
change host name in nmon_data Hello I want to change host name in TA-nmon and I have set the value of override_sys_hostname in /dbdata1/splunkforwa... by khmohammadzadeh New Member in Getting Data In 07-17-2018 0 4	0	4
How can I get member users groups from Microsoft Azure AD? Hi Splunkers I am working with Azure AD and Splunk Cloud and I need to get information about member's group like who... by evinasco Communicator in Getting Data In 07-17-2018 0 1	0	1
Will Splunk run a modular input using system Python on a Universal Forwarder If I have a modular input written in Python, will Splunk attempt to execute it on a Universal Forwarder if the host h... by LukeMurphey Champion in Getting Data In 07-17-2018 1 6	1	6
How to check if indexer is writing cold to frozen? I have an ec2 splunk instance writing frozen data to an s3 bucket (via s3fs). Where would I find in the splunk logs ... by Log_wrangler Builder in Getting Data In 07-17-2018 0 2	0	2
Trouble extracting time in JSON I have a JSON log file that I'm attempting to ingest (Splunk v6.6.5). The events parse correctly, but the epoch time... by ericlarsen Path Finder in Getting Data In 07-17-2018 0 2	0	2
use transforms.conf or props.conf to convert multi line event to single event on forwarder level to send external to Splunk I would like to convert an event similar to the one below to be a single event when sending it out to an external Sys... by ssyed2009 New Member in Getting Data In 07-17-2018 0 2	0	2
Accepted time is suspiciously far away from the previous event's time I'm ingesting logs that have both event timestamps as well as timestamps within the contents of the logs. My props.c... by bschaap Path Finder in Getting Data In 07-17-2018 0 2	0	2
How to fix splunk replication Hi guys. In my splunk cluster i've distributed search indexers. On one of them I've this message. What can I fix thi... by GenRockeR Explorer in Getting Data In 07-17-2018 0 2	0	2
How to figure out what an instance is considered if I am on the deployment server, client, search head, forwarder, or indexer? Hi there, I'm fairly new to Splunk and I am still a bit confused as to how I can tell what an instance is considered.... by Zamoraw New Member in Getting Data In 07-17-2018 0 1	0	1
Windows Universal forwarder shows 2 host names for the same server Hello, We have a single instance splunk deployment. I have installed Universal Forwarder on an Win 2012 R2 Active ... by neerajshah81 Path Finder in Getting Data In 07-17-2018 0 6	0	6
Can the "exception" log record that looks different from the regular log records and is spanned across a bunch of lines be indexed as one Splunk event? The whole log goes to the same sourcetype. Can the "exception" log record that looks different from the regular log records and is spanned across a bunch of lin... by yg Explorer in Getting Data In 07-17-2018 0 2	0	2
Modifying modular input's local inputs.conf via the REST API Hi all, I'm trying to change specific values of a modular input's inputs.conf from within the modular input itself. A... by alexm_zfox New Member in Getting Data In 07-17-2018 0 2	0	2
What is Splunk data life cycle? Can someone explain to me splunk data life cycle? input, parsing, indexing, and search? by patricianaguit Explorer in Getting Data In 07-16-2018 0 1	0	1
Why is my file not being indexed? I'm trying to on-board a new application and having issues from the get go. Application is IBM IIB and outputs logs ... by Kozanic Path Finder in Getting Data In 07-16-2018 0 3	0	3
Things you can not do with forwarder license Hi, I applied a forwarder license with Enterprize installer and built a forwarder. I want to know the list of things ... by t_kasuga New Member in Getting Data In 07-16-2018 0 3	0	3
Renaming index for data coming from universal forwarder We have data coming from lots of universal forwarders and it has various sources and sourcetypes and sending data onl... by nawazns5038 Builder in Getting Data In 07-16-2018 0 2	0	2
Does Splunk use alphabetical order for datetime.xml parsing? Is there a sequence Splunk uses (like alphabetical order) for datetime.xml ? As an example, time pattern "use_this-la... by anoopambli Communicator in Getting Data In 07-16-2018 0 1	0	1
Can you simply delete the 6.4.3 forwarder and installing the 7.2.1 forwarder? Hi. We are running Splunk Enterprise 6.4.3, and our Universal Forwarders are running the same version. We'll be upgra... by Branden Builder in Getting Data In 07-16-2018 0 2	0	2
How to mask SSN into our logs going into Splunk? Our code leaked SSNs into our logs and they went into Splunk, so i'm trying to mask it. I tried it two ways (BTW, th... by ronerf Explorer in Getting Data In 07-16-2018 0 8	0	8
When does splunk roll data from warm to cold? On my test environement I configured and index like this: [prove_di_cold] homePath = /root/splunk_hot/prove_di_cold/... by robertosegantin Path Finder in Getting Data In 07-16-2018 0 3	0	3