Getting Data In

Community Activity

props/transforms.conf Hi, I have the below data and I know that props and/or transforms.conf need to be modified to have the below report ... by dbcase Motivator in Getting Data In 05-23-2018 0 2	0	2
What is a good replacement to monitor Active Directory with Splunk 7.x? I am trying to monitor changes in Active Directory and found a number of ways to ingest data from AD. Splunk Add-on f... by snix Communicator in Getting Data In 05-23-2018 0 3	0	3
unifi USG syslog to Splunk enterprise Good Morning, I configured my Unifi USG to send logs to the splunk server on udp 514, created a receiver udp 514. I ... by wbarrett12 New Member in Getting Data In 05-23-2018 0 4	0	4
IIS logs creating licensing issue Hello, We recently completed a SOW with Splunk Professional Services. As part of the SOW we cleaned up apps, scripts... by andyadino Engager in Getting Data In 05-23-2018 0 1	0	1
Count number of events from IIS logs. I would like to group it by Country, source IP, destination IP, sum(cs_bytes), sum(sc_bytes) where the country is the... by tundeawe New Member in Getting Data In 05-23-2018 0 6	0	6
How to parse epoch time in SNMP log? I would like to parse timestamp for Windows SNMP logs Below is log "{""MibList"":[{""OID"":""1.3.6.1.4.1.311.1.13.1... by Niraj_Shah New Member in Getting Data In 05-23-2018 0 4	0	4
Will splunk provide pivot REST api to use in the apps? Hello, With reference to my previous question, (https://answers.splunk.com/answers/660382/how-to-customize-the-pivot... by gopiktr Engager in Getting Data In 05-23-2018 0 0	0	0
syslog configuration First Part I configure central syslog server where I planned to have all logs from all syslog devices. my syslog conf... by riqbal Communicator in Getting Data In 05-23-2018 0 6	0	6
How can I force Splunk to reread a config file every now and then in addition to when it changes? All, I am bringing in a number of configs as sourcetype=config_file via inputs.conf and I am pretty happy with it. ... by daniel333 Builder in Getting Data In 05-22-2018 0 4	0	4
Windows DHCP Logs I am having trouble getting a Splunk forwarder (4.1.2) to send Windows 2008 R2 DHCP logs back to the main Splunk inde... by Justin Path Finder in Getting Data In 05-22-2018 3 7	3	7
Can you auto remove CSV files after indexing? Is there a configuration in Splunk where it can remove/move a CSV file after it has been indexed? so it does not show... by jiaqya Builder in Getting Data In 05-22-2018 0 4	0	4
Why is the log time different than the system time? I have been beating my head against the wall on this one for a few days now. I have tried every suggestion I can find... by pdgill314 Path Finder in Getting Data In 05-22-2018 0 6	0	6
What can be done when port 8089 is taken on the forwarder? We reach a situation where port 8089 is being used by another app on a set of forwarders. Can we use another port on ... by ddrillic Ultra Champion in Getting Data In 05-22-2018 0 11	0	11
How Do I Remove Device From Splunk Server Class? Hello everyone. I am managing Windows and Mac devices via the Splunk DMC. Because of an error I made in the Splunk Se... by nmensah Explorer in Getting Data In 05-22-2018 0 4	0	4
Transform to nullQueue depends on search? Hello, I've been spending the last month experimenting with Splunk. Lately, i've tried to reroute a specific event t... by Burritobizon Engager in Getting Data In 05-22-2018 0 3	0	3
Need some more clarification on _meta value while using. Hi Folks, we have ingested the logs from microsoft azure using microsoft cloud services app on HF and we added some ... by lksridhar Explorer in Getting Data In 05-22-2018 0 5	0	5
How to get total comma separated values in splunk? Hi all, I am getting event like this Im trying to get total values with the comma separated but I am not getting t... by ajayabburi508 Path Finder in Getting Data In 05-22-2018 0 4	0	4
How can I only show rows from next 6 months based on the datestamp? I am trying to only show records that have "md_createdAt" fields that occur in the next 6 months, looking forward fro... by rkassabov Path Finder in Getting Data In 05-21-2018 0 5	0	5
Updated : JSON event break for multiple source type and single event in multiple lines. Hi, I am uploading json file having 2 different source type and single event is split multiple lines. I am very clo... by AKG1_old1 Builder in Getting Data In 05-21-2018 0 2	0	2
Configuring Splunk for Multiple Indexer Partitions I am not sure how to configure the indexes.conf AND the splunk-launch.conf. I understand multiple volumes in indexes... by gbowden_pheaa Path Finder in Getting Data In 05-21-2018 0 6	0	6
Why is our dispatch directory getting full with strange CSV files? Hi, Our dispatch directory is getting full with some newly created srfiletmp_420128713.csv like files. These files a... by thezero Path Finder in Getting Data In 05-21-2018 3 5	3	5
Universal forward installed on windows server but can't get the logs for that server. Hi Everyone, I am testing universal forwarding in our testing environment and also installed universal forwarder in ... by Sagar0511 Explorer in Getting Data In 05-21-2018 0 3	0	3
Splunk DSYM upload script in build phase is returning 400 Splunk DSYM upload script in build phase is returning 400 while contacting the server, and failing the builds. I tri... by sjun Explorer in Getting Data In 05-21-2018 4 6	4	6
syslog indexing However at this point I am getting logs from syslog data source and they are saved at /central/$hostname$/gateway.log... by riqbal Communicator in Getting Data In 05-21-2018 0 4	0	4
How to forward Windows event log "application" to 2 different indexes? Our Splunk 6.1.5 environment is on Linux. We have universal forwarders installed on our windows machines. They are al... by KooroshFooladba Explorer in Getting Data In 05-21-2018 0 7	0	7