Getting Data In

Community Activity

Why are Windows event logs with MSSQLSERVER$AUDIT as source getting truncated and the message is empty? Hi, We have an auditing setup which logs in Windows event logs (Forwarded Events) as "MSSQLSERVER$AUDIT" source. th... by gregory_cordier Explorer in Getting Data In 04-03-2018 0 2	0	2
How to monitor Active Directory changes and security events with Universal forwarder? We want to monitor Active Directory changes and security Events We are planning to deploy the Universal forwarder to ... by jared_anderson Path Finder in Getting Data In 04-03-2018 0 4	0	4
How to configure rsyslog so that it stores them in certain directories? I would like to configure rsyslog so that it keeps logs generated by the localhost in the /var/log/messages but then ... by MedralaG Communicator in Getting Data In 04-03-2018 0 7	0	7
How can we view the data retention policy we have set? Hi All, We have set the data retention has 1 year (365 days) for in cluster master. But when we search the data in S... by anandhalagarasa Path Finder in Getting Data In 04-03-2018 1 5	1	5
Why is the Splunk Universal Forwarder sending data to wrong index and, isn't sending all records of a Catalina.out? Hello everyone, I have a lab in a Ubuntu VM. In this lab, I have the UF and the Splunk E. The forwarder monitors a f... by sebardgz New Member in Getting Data In 04-03-2018 0 6	0	6
timestamp match is outside of the acceptable time window Hello, I have a log with a timestamp that does not contain the year. Moreover the events are not in a chronological o... by clorne Communicator in Getting Data In 04-03-2018 0 2	0	2
Can Sysmon logs completely take the place of certain "Event Logs"? So we are wondering if by implementing the collection of Sysmon logs, we can stop collecting other logs all together.... by Kinngk789 New Member in Getting Data In 04-02-2018 0 1	0	1
Are there inconsistencies in behavior with the need for INDEXED_EXTRACTIONS? The admin class (lab) says that for json we need the following in the props.conf of the forwarder. INDEXED_EXTRACTIO... by ddrillic Ultra Champion in Getting Data In 04-02-2018 0 2	0	2
Why can't the Splunk server index or show events forwarded by windows host with universal forwarder? alt text I have installed universal forwarder on my windows host and the forwarder does forward the events to the Spl... by josue198_s New Member in Getting Data In 04-02-2018 0 2	0	2
Why am I not getting syslogs on port 512? I am new to Splunk and I have it installed on my PC at work. I have Aruba Clear Pass syslog target set to forward to ... by tabbtharrington New Member in Getting Data In 04-02-2018 0 2	0	2
How to restrict transaction to group events from the same source and the same host? Search a same log file on many different hosts . Use transaction : startwith and endwith to capture one process w... by xinde Path Finder in Getting Data In 04-02-2018 0 2	0	2
Why does Splunk always get en-GB instead of en-US on the url? Is there a way to change the URL form en-GB to en-US so the dateTime picker shows MM/DD/YY? http://1xx.1xx.1xx.1xx:9... by pachurrito62 Explorer in Getting Data In 04-02-2018 1 2	1	2
How to create an If Statement in Props.conf? I need to set a value based on another value. How would I do this: if severity = 1 severity=high One of my cust... by pfabrizi Path Finder in Getting Data In 04-02-2018 0 2	0	2
Is there a way to use some sort of regular expression with field aliases? Is there a way to simply the props.conf configurations and do the following in one command - FIELDALIAS-alias01 = "a... by ddrillic Ultra Champion in Getting Data In 04-02-2018 0 3	0	3
How can I forward data from UniversalForwarder for 2 instances? I have universal forwarder with Splunk_TA_Stream and my app _server_app_audit where in inputs.conf I write _TCP_Routi... by Klimdy Explorer in Getting Data In 04-02-2018 0 2	0	2
How to redirect logs to separate indexes based on host? Hi.. I have a question From a heavy forwarder , based on the incoming host, I like to send the logs into a separate... by roysoman Engager in Getting Data In 04-02-2018 0 3	0	3
Why does the csv sourcetype work for upload but not via the forwarder? The following sourcetype works fine when we upload a file against this sourcetype, but via the forwarder the csv fiel... by ddrillic Ultra Champion in Getting Data In 04-01-2018 0 12	0	12
how do i find where each hosts are indexing data the reason for this is because someone made a mix-up on the UF and then some hosts are indexing to the wrong index. I... by ranjitbrhm1 Communicator in Getting Data In 04-01-2018 0 2	0	2
How to create a summary Index that will give license usage by index and sourcetype? Hi All, I am trying to create a summary index which will gives us the license usage by index and sourcetype, which w... by siva_cg Path Finder in Getting Data In 03-31-2018 0 4	0	4
How to assign a field alias to a json field? We have the following in props.conf - FIELDALIAS-alias1 = apiRequest.apiInfo.clientID AS clientID It doesn't seem ... by ddrillic Ultra Champion in Getting Data In 03-31-2018 0 3	0	3
How to search for logins not in CSV? I am trying to write a query in Splunk that will tell me if any user IDs in my CSV file were used to log into any mac... by albert111 New Member in Getting Data In 03-31-2018 0 3	0	3
Can splunk monitor a google drive folder as a data input? Not sure if it is possible, but before I try, thought I would ask. I need to ingest json files uploaded to a google ... by Log_wrangler Builder in Getting Data In 03-30-2018 1 1	1	1
Why can't I download universal forwarder credentials on macOS High Sierra 10.13.3? When I tried to download the Universal Forwarder Credentials from my trial Splunk Cloud on to my MacBook Pro, I got a... by PaulTszeYuenChu Explorer in Getting Data In 03-30-2018 0 1	0	1
Why does the CIDR not include all IP's in a range? I have a big corporate network with many routers. All routes ha a loopback IP used for syslog. Ex 10.252.1.10/32 Wh... by lakromani Builder in Getting Data In 03-30-2018 0 2	0	2
New Universal Forwarder read timeout We are trying to setup the universal forwarder on a Windows AD server. After configuring the index to receive on port... by tinylund Explorer in Getting Data In 03-30-2018 0 4	0	4

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Getting Data In

Why are Windows event logs with MSSQLSERVER$AUDIT as source getting truncated and the message is empty?

How to monitor Active Directory changes and security events with Universal forwarder?

How to configure rsyslog so that it stores them in certain directories?

How can we view the data retention policy we have set?

Why is the Splunk Universal Forwarder sending data to wrong index and, isn't sending all records of a Catalina.out?

timestamp match is outside of the acceptable time window

Can Sysmon logs completely take the place of certain "Event Logs"?

Are there inconsistencies in behavior with the need for INDEXED_EXTRACTIONS?

Why can't the Splunk server index or show events forwarded by windows host with universal forwarder?

Why am I not getting syslogs on port 512?

How to restrict transaction to group events from the same source and the same host?

Why does Splunk always get en-GB instead of en-US on the url?

How to create an If Statement in Props.conf?

Is there a way to use some sort of regular expression with field aliases?

How can I forward data from UniversalForwarder for 2 instances?

How to redirect logs to separate indexes based on host?

Why does the csv sourcetype work for upload but not via the forwarder?

how do i find where each hosts are indexing data

How to create a summary Index that will give license usage by index and sourcetype?

How to assign a field alias to a json field?

How to search for logins not in CSV?

Can splunk monitor a google drive folder as a data input?

Why can't I download universal forwarder credentials on macOS High Sierra 10.13.3?

Why does the CIDR not include all IP's in a range?

New Universal Forwarder read timeout

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

How to integrate threat armor with splunk?

How to integrate Google Cloud armor with splunk?

Getting Data In

Join the Conversation