Getting Data In

Community Activity

Splunk Add on For AWS - Generic S3 input I have setup splunk add-on for AWS. For generic S3 bucket, we tried to add different format files into the bucket. Th... by caughtnakul New Member in Getting Data In 06-29-2018 0 0	0	0
,Guacamole Docker logs in Splunk Hi, I would like the Guacamole logs to get forwarded to the Splunk server and I added the log forwarding parameters... by tezarin New Member in Getting Data In 06-29-2018 0 5	0	5
Why am I encountering a bug when accessing nested JSON field values? There seems to be a bug searching events with JSON data if the field names are nested. For example: sourcetype=cmdb... by responsys_cm Builder in Getting Data In 06-29-2018 0 2	0	2
Collect remote files using SFTP Hi all, Is there any native way of configuring splunk or forwarders to periodically collect files using SFTP ? It... by npr72 New Member in Getting Data In 06-29-2018 0 3	0	3
Help extracting and paring nested JSON for table I'm indexing some JSON data that describes an AWS security group. Inside this JSON are nested pairs of port combinati... by dwodeyla_bit9 Engager in Getting Data In 06-29-2018 0 5	0	5
len(_raw) vs \|dbinspect rawSize I use a simple query to determine the amount of data I've sent to splunk: index=x \|eval esize=len(_raw) \|timechart s... by Hoekb03 Explorer in Getting Data In 06-29-2018 0 1	0	1
How to use spath command in props.conf or transforms.conf in Splunk? Hello , I used spath command to extract field from json data: {"key":"value", "key":"value", "key":"value", "key":"... by MAMAOUI Explorer in Getting Data In 06-29-2018 0 4	0	4
Getting issue while parsing event which have no timestamp in logs Getting issue while parsing events which have no timestamp in logs, it should use date\time from last log event times... by ashikuma Explorer in Getting Data In 06-29-2018 0 9	0	9
Can Splunk read a file in JSON format? We are trying to pull in slack data using function1 which is not work as we are using the new api. We had a call with... by pfabrizi Path Finder in Getting Data In 06-29-2018 0 4	0	4
How to mass delete knowledge objects in version 7.0? I've got a large number of orphaned objects that I'd like to clean up (delete). I don't see any way to do this in th... by the_wolverine Champion in Getting Data In 06-28-2018 0 5	0	5
Can I do an if else in a props.conf? I am using Graylog to forward my windows events, all the events field names start with winlogbeat, but some are _even... by pfabrizi Path Finder in Getting Data In 06-28-2018 0 2	0	2
How to split multiple lines in a table into separate rows? I have some data from Tenable and I am trying to weed out the rows with multiple values into its own row. A good e... by jimmynguy Explorer in Getting Data In 06-28-2018 0 4	0	4
crcSalt is not working I ingested SQL ERRORLOGs and SQLAGENT logs with my forwader but didn't have the props.conf setup correctly. They show... by thisissplunk Builder in Getting Data In 06-28-2018 0 9	0	9
How would I filter out fields via Props.conf? I am forwarding windows events from graylog to a UF and then UF to Indexer. I have a props.conf to create field alias... by pfabrizi Path Finder in Getting Data In 06-28-2018 0 2	0	2
How to define custom index and sourcetype for Universal Forwarder Hi, I am using an Universal Forwarder to send a specific file to a Splunk instance on another machine. On this machi... by harshal_chakran Builder in Getting Data In 06-28-2018 2 4	2	4
Ingesting files with updated first line I got a file which get new log entries during the day, when a user logs out, the first line of the log is updated wit... by erikgrasman Engager in Getting Data In 06-27-2018 0 4	0	4
How to collect perfmon data on .NET counters? I am attempting to collect perfmon counters to track garbage collection in a .NET application. I can create the co... by anewell Path Finder in Getting Data In 06-27-2018 0 3	0	3
Files & Directories: Path does not exist I have four files in the same directory, "/opt/SplunkData". I can see three of them in "Manager » Data inputs » Files... by kmattern Builder in Getting Data In 06-27-2018 1 6	1	6
How to find .conf files on a splunk interface which is only accessible via a URL? I need to locate the savedsearches.conf on a Splunk web server i.e. I can only reach this Splunk instance with a URL.... by hunterpj Path Finder in Getting Data In 06-27-2018 0 5	0	5
Is there a way to split the default savedsearches.conf from the local one? I am using a search command to find the savedsearches.conf for an alert. I created a search which can list all of the... by hunterpj Path Finder in Getting Data In 06-27-2018 0 3	0	3
My Splunk Performance is Significantly Worse in my Upgraded Version to 7.1.1 so I upgraded my Splunk version from 6.3.3 to 7.1.1, put it on a new server, split out the volumes on my server and t... by katzr Path Finder in Getting Data In 06-27-2018 0 1	0	1
moving "spath" from query to config file Hi All I want to move the spath from search query to the auto extraction configuration ie in props.conf and transform... by splunk_worker Path Finder in Getting Data In 06-27-2018 4 3	4	3
Index only new lines Hi. I have a requirement of a client, he has a file that indexes every day, but that file is modified at different t... by grivera_kudaw Explorer in Getting Data In 06-27-2018 0 1	0	1
How can I delete all double quotes in input data before it import to splunk? I have a csv file in which it contains random double quotes and I want to remove all these quotes before it actually ... by tamduong16 Contributor in Getting Data In 06-27-2018 0 6	0	6
How to monitor and alert on a folder for an unindexed file due to no matching sourcetype I am looking for a way to monitor a folder for files that are [not yet defined] into a sourcetype so that i can have ... by dmcgeearke Explorer in Getting Data In 06-27-2018 0 2	0	2