Getting Data In

Community Activity

Graylog sending to SPLUNK over 9997 I have Graylog forwarding to a UF over port 9997 and I see events streaming in but not being picked up by SPLUNK. I h... by pfabrizi Path Finder in Getting Data In 06-21-2018 0 8	0	8
universal forwarder is taking about 30GB of Memory - Is this normal? Hi My universal forwarder is taking about 30GB and my IT guys are asking is this normal. I have just restarted it an... by robertlynch2020 Influencer in Getting Data In 06-21-2018 0 11	0	11
Is it possible to list out empty index Hi, I am working on index="retail_ca", The problem with this index is some days the data is not ingesting in this i... by chandana204 Communicator in Getting Data In 06-20-2018 0 20	0	20
Additional search in REST API results enpoint I'm using curl and the REST API to submit a job and fetch the results by search id. What I'd like to do is, rather th... by ecmcn New Member in Getting Data In 06-20-2018 0 0	0	0
Is it possible to create a command that launches a powershell script? We currently have a PowerShell script that queries one of our EDR solutions and returns all data for the specified ho... by ng87 Path Finder in Getting Data In 06-20-2018 0 8	0	8
Forward data from logstash-forwarder to Splunk Indexer Hi all, we have an ELK-cluster in our company and now we want to have the data, we have in ELK, as well in Splunk. I... by yAlff Path Finder in Getting Data In 06-20-2018 2 4	2	4
How to split multiple lines of data into a single individual line in splunk? Hi All, We are monitoring the wtmpx data from the Unix machines via splunk using the Splunk add-on for Unix, based o... by Hemnaath Motivator in Getting Data In 06-20-2018 0 1	0	1
Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra? Hi there, I'm new to Splunk and am testing out installing splunk forwarder on some Mac clients running High Sierra f... by charvey007 Engager in Getting Data In 06-20-2018 1 3	1	3
Splunk - Server and Application logs timestamps are different We have a set of servers where the server Timezone is in PST/PDT but the application running on that server has log t... by vilashegde New Member in Getting Data In 06-20-2018 0 1	0	1
Why does the forwarder stops sending data to all configured TCP connections when one connection is not available? Hello, I'm new to splunk and hope you can help me with this problem. I'm using Universal forwarder to send data from... by dami_rel Engager in Getting Data In 06-20-2018 1 2	1	2
why are my configurations not working even after reboot? The log files I'm working with are using the log4j syntax, and I'm loading them into splunk through the GUI (not real... by julienoud New Member in Getting Data In 06-20-2018 0 3	0	3
Why is the TIMESTAMP_FIELDS setting in props.conf, on the Universal Forwarder, not taken into account? I have the issue that the TIMESTAMP_FIELDS setting in the props.conf on the Universal Forwarder is not taken into acc... by sander_vandamme Path Finder in Getting Data In 06-20-2018 0 7	0	7
Forwarder refusing to start My forwarder was working fine but stopped and I can't get it running again. Running the splunk start command appears ... by mawomommoh Path Finder in Getting Data In 06-20-2018 0 3	0	3
"ERROR DistributedPeerManagerHeartbeat - A time skew of approximately 61 seconds exists between this search head and peer indexer1" Hi Splunkers, I'm getting the following error on my search head's splunkd.log: ERROR DistributedPeerManagerHeartbea... by sympatiko Communicator in Getting Data In 06-19-2018 0 10	0	10
Event and log timestamps are off by a bit Local splunk server timezone is GMT. Incoming firewall logs are in Eastern. But when I query, the times are off w... by sprimerib New Member in Getting Data In 06-19-2018 0 1	0	1
Encountering a "command not found" error when executing rebuild command Hello, I executed the below command on an indexer but received a "rebuild: command not found" error message: splunk... by adnankhan5133 Communicator in Getting Data In 06-19-2018 0 7	0	7
In Splunk hec, what should you check if you cannot search fields from http event collector in SHC? With Splunk HEC it is possible to send a HTTP POST with Json payload to services/collector/event. This supports the f... by larshaugan Explorer in Getting Data In 06-19-2018 0 1	0	1
How can I change the output of a search job to JSON? I'm not a developer, so please bear with me. i'm using service.savedSearches.fetch, then mySavedSearch.dispatch(func... by mwcooley Explorer in Getting Data In 06-19-2018 0 1	0	1
Splunk Forwarder with DB Connect : connection not closed with Splunk Indexer I am using Splunk Heavy Forwader with DB Connect to forward data to a Splunk Indexer instance. Although the HF is not... by mbennani3492 Engager in Getting Data In 06-19-2018 0 2	0	2
GeneratingCommand intended behaviour? I've been writing custom commands using SCP1, particularly using splunk.Intersplunk.outputStreamResults and it's been... by stephenmcglade Engager in Getting Data In 06-19-2018 0 0	0	0
How to edit my props and transforms to filter out certain phrases in ASA logs? Hi, I've read a few articles on filtering data inputs. Basically I have a noisy ASA that I'm logging, and I want to... by jlarkins New Member in Getting Data In 06-19-2018 0 4	0	4
How to extract timestamp without destroying the sequence of original events from my sample data? Hi, I have the following sample event data. - For some reason, there is no sub-seconds-order data for the timestamp... by tac24 New Member in Getting Data In 06-18-2018 0 3	0	3
How to collect logs from multi Box account Hi folks, I have three contracts of Box services, and I try to gather box transaction logs by API. I could get box lo... by syokota_splunk Splunk Employee in Getting Data In 06-18-2018 0 2	0	2
TRANSFORMS-ROUTING filtering out source address I have set up a TRANSFORMS-ROUTING and it is forwarding data to a 3rd party however, they do not want to see the sour... by sbattista09 Contributor in Getting Data In 06-18-2018 0 2	0	2
Heavy Forwarder vs. Reduced Splunk Enterprise & DB Connect App Hello everyone! My team and I are attempting to create a service for our departments' applications that enable them ... by thomastaylor Communicator in Getting Data In 06-18-2018 0 3	0	3