Getting Data In

Community Activity

What is Splunk data life cycle? Can someone explain to me splunk data life cycle? input, parsing, indexing, and search? by patricianaguit Explorer in Getting Data In 07-16-2018 0 1	0	1
Why is my file not being indexed? I'm trying to on-board a new application and having issues from the get go. Application is IBM IIB and outputs logs ... by Kozanic Path Finder in Getting Data In 07-16-2018 0 3	0	3
Things you can not do with forwarder license Hi, I applied a forwarder license with Enterprize installer and built a forwarder. I want to know the list of things ... by t_kasuga New Member in Getting Data In 07-16-2018 0 3	0	3
Renaming index for data coming from universal forwarder We have data coming from lots of universal forwarders and it has various sources and sourcetypes and sending data onl... by nawazns5038 Builder in Getting Data In 07-16-2018 0 2	0	2
Does Splunk use alphabetical order for datetime.xml parsing? Is there a sequence Splunk uses (like alphabetical order) for datetime.xml ? As an example, time pattern "use_this-la... by anoopambli Communicator in Getting Data In 07-16-2018 0 1	0	1
Can you simply delete the 6.4.3 forwarder and installing the 7.2.1 forwarder? Hi. We are running Splunk Enterprise 6.4.3, and our Universal Forwarders are running the same version. We'll be upgra... by Branden Builder in Getting Data In 07-16-2018 0 2	0	2
How to mask SSN into our logs going into Splunk? Our code leaked SSNs into our logs and they went into Splunk, so i'm trying to mask it. I tried it two ways (BTW, th... by ronerf Explorer in Getting Data In 07-16-2018 0 8	0	8
When does splunk roll data from warm to cold? On my test environement I configured and index like this: [prove_di_cold] homePath = /root/splunk_hot/prove_di_cold/... by robertosegantin Path Finder in Getting Data In 07-16-2018 0 3	0	3
How to split single field value into two different values? Hello, I'm trying to split a single value of a result which is 5231562. I want to be able to split this number into ... by alex389 Engager in Getting Data In 07-16-2018 0 5	0	5
Defining time column in .csv uploaded Good afternoon. This question might be already answered. But so far I searched I had no luck in understanding how to... by kiraitachi Engager in Getting Data In 07-16-2018 0 4	0	4
how to Count warm buckets per indexer per index I've been trying to evaluate and control the space being used in our hot/warm vol. I am trying to run searches that... by saulverde Path Finder in Getting Data In 07-16-2018 0 6	0	6
How to troubleshoot why my universal forwarder is not phoning home? I installed my universal forwarder on an Ubuntu server. I have successfully established a connection to my Splunk Ent... by w0lverineNOP Path Finder in Getting Data In 07-16-2018 2 6	2	6
What are the different types of data ingestion? Hi i just would like to know the different types of data ingestion and an overview about it Thanks in advance! by patricianaguit Explorer in Getting Data In 07-16-2018 1 1	1	1
How to extract fields without a name from a JSON event? Hi all, I'm using virtual index to access log files stored in Hadoop and then trying to extract certain values from J... by dannili Communicator in Getting Data In 07-15-2018 0 3	0	3
How to get the top 1 data per host? I have a log where the mount usage of every host gets logged. So there can be multiple mounts per host. The data can ... by anirban_nag Explorer in Getting Data In 07-15-2018 0 4	0	4
Why am I not seeing custom logs using the universal forwarder? I am using the UF to try and collect logs from a custom windows application. Below is my inputs.conf stanza. How I am... by pfabrizi Path Finder in Getting Data In 07-15-2018 0 1	0	1
Will I still be able to forward data into the instance and create searches after the Enterprise trial ends? I currently have an Enterprise trial license and was wondering what would happen after the trial ends. Will I still b... by Zamoraw New Member in Getting Data In 07-15-2018 0 2	0	2
Why is the batch input not indexing certain files? I have created a sub folder on a windows splunk indexer in which each night a sub directory named for today's date wi... by grantsmiley Path Finder in Getting Data In 07-13-2018 0 4	0	4
Can I have different versions of Splunk Enterprise in a distributed environment? Can I have different versions of Splunk Enterprise within the same Splunk distributed environment? i.e. could I have... by dyeo Engager in Getting Data In 07-13-2018 0 3	0	3
How to get json portion of log entry to display as formatted JSON? Hey gang - hopefully this isn't to bad of a question and I'm missing something simple. I have an application that is... by ShagVT Path Finder in Getting Data In 07-13-2018 0 4	0	4
How to trouble shoot Security Logs with Low Event Count logs are not parsing at realtime? Hi All, We have been notified by the security team as they are seeing low security events counts and the logs are no... by Hemnaath Motivator in Getting Data In 07-13-2018 0 1	0	1
How to add a data input in Server GUI that modifies the inputs.conf file in the Universal Forwarders? Hi: I'm using Splunk in a Mac OS X system. I've installed Universal Forwarders in several Windows Machines. I 've us... by leantricity New Member in Getting Data In 07-12-2018 0 2	0	2
I can't assign `can_delete` to default user `admin`. I am facing a problem similar to the following Answers! https://answers.splunk.com/answers/549958/admin-like-account... by yutaka1005 Builder in Getting Data In 07-12-2018 1 3	1	3
Force UF(6.4.5) and Deployment Server(6.2.3) to use TLS 1.2 https://answers.splunk.com/answers/468642/deployment-server-flooded-with-ssl-handshake-error-1.html By seeing answer... by yutaka1005 Builder in Getting Data In 07-12-2018 0 5	0	5
How to Delete Duplicate Events We have a search that captures the count per host every 10 minutes and puts the results into a summary index. For som... by I-Man Communicator in Getting Data In 07-12-2018 0 6	0	6