Getting Data In

Community Activity

How to edit my configurations so that my Kubernetes host log will be reformatted entering Splunk? Hi , In my kubernetes host generating logfile for the docker container, the logs are coming to Splunk in the followi... by svemurilv Path Finder in Getting Data In 04-03-2018 0 5	0	5
How to create dump command and put datetime? Hi Ask about basefilename in dump command. I would like to create a file by date with search results and I would lik... by khyoung7410 Communicator in Getting Data In 04-03-2018 0 1	0	1
Why am I encountering an Error on forwarding nginx container logs to Splunk forwarder? https://www.splunk.com/blog/2015/08/24/collecting-docker-logs-and-stats-with-splunk.html With reference to this docu... by eygtmbot Engager in Getting Data In 04-03-2018 0 3	0	3
indexing congestion consistenly happening Hi, I have only started using splunk on a test server, and I am consistently getting "skipped indexing of internal a... by sventura15 Explorer in Getting Data In 04-03-2018 1 6	1	6
How do you change apps in in the API (Java)? So I am following the Java Splunk API tutorials and Can list apps and saved searches but for the life of me I cannot ... by scottq New Member in Getting Data In 04-03-2018 0 0	0	0
Why are Windows event logs with MSSQLSERVER$AUDIT as source getting truncated and the message is empty? Hi, We have an auditing setup which logs in Windows event logs (Forwarded Events) as "MSSQLSERVER$AUDIT" source. th... by gregory_cordier Explorer in Getting Data In 04-03-2018 0 2	0	2
How to monitor Active Directory changes and security events with Universal forwarder? We want to monitor Active Directory changes and security Events We are planning to deploy the Universal forwarder to ... by jared_anderson Path Finder in Getting Data In 04-03-2018 0 4	0	4
How to configure rsyslog so that it stores them in certain directories? I would like to configure rsyslog so that it keeps logs generated by the localhost in the /var/log/messages but then ... by MedralaG Communicator in Getting Data In 04-03-2018 0 7	0	7
How can we view the data retention policy we have set? Hi All, We have set the data retention has 1 year (365 days) for in cluster master. But when we search the data in S... by anandhalagarasa Path Finder in Getting Data In 04-03-2018 1 5	1	5
Why is the Splunk Universal Forwarder sending data to wrong index and, isn't sending all records of a Catalina.out? Hello everyone, I have a lab in a Ubuntu VM. In this lab, I have the UF and the Splunk E. The forwarder monitors a f... by sebardgz New Member in Getting Data In 04-03-2018 0 6	0	6
timestamp match is outside of the acceptable time window Hello, I have a log with a timestamp that does not contain the year. Moreover the events are not in a chronological o... by clorne Communicator in Getting Data In 04-03-2018 0 2	0	2
Can Sysmon logs completely take the place of certain "Event Logs"? So we are wondering if by implementing the collection of Sysmon logs, we can stop collecting other logs all together.... by Kinngk789 New Member in Getting Data In 04-02-2018 0 1	0	1
Are there inconsistencies in behavior with the need for INDEXED_EXTRACTIONS? The admin class (lab) says that for json we need the following in the props.conf of the forwarder. INDEXED_EXTRACTIO... by ddrillic Ultra Champion in Getting Data In 04-02-2018 0 2	0	2
Why can't the Splunk server index or show events forwarded by windows host with universal forwarder? alt text I have installed universal forwarder on my windows host and the forwarder does forward the events to the Spl... by josue198_s New Member in Getting Data In 04-02-2018 0 2	0	2
Why am I not getting syslogs on port 512? I am new to Splunk and I have it installed on my PC at work. I have Aruba Clear Pass syslog target set to forward to ... by tabbtharrington New Member in Getting Data In 04-02-2018 0 2	0	2
How to restrict transaction to group events from the same source and the same host? Search a same log file on many different hosts . Use transaction : startwith and endwith to capture one process w... by xinde Path Finder in Getting Data In 04-02-2018 0 2	0	2
Why does Splunk always get en-GB instead of en-US on the url? Is there a way to change the URL form en-GB to en-US so the dateTime picker shows MM/DD/YY? http://1xx.1xx.1xx.1xx:9... by pachurrito62 Explorer in Getting Data In 04-02-2018 1 2	1	2
How to create an If Statement in Props.conf? I need to set a value based on another value. How would I do this: if severity = 1 severity=high One of my cust... by pfabrizi Path Finder in Getting Data In 04-02-2018 0 2	0	2
Is there a way to use some sort of regular expression with field aliases? Is there a way to simply the props.conf configurations and do the following in one command - FIELDALIAS-alias01 = "a... by ddrillic Ultra Champion in Getting Data In 04-02-2018 0 3	0	3
How can I forward data from UniversalForwarder for 2 instances? I have universal forwarder with Splunk_TA_Stream and my app _server_app_audit where in inputs.conf I write _TCP_Routi... by Klimdy Explorer in Getting Data In 04-02-2018 0 2	0	2
How to redirect logs to separate indexes based on host? Hi.. I have a question From a heavy forwarder , based on the incoming host, I like to send the logs into a separate... by roysoman Engager in Getting Data In 04-02-2018 0 3	0	3
Why does the csv sourcetype work for upload but not via the forwarder? The following sourcetype works fine when we upload a file against this sourcetype, but via the forwarder the csv fiel... by ddrillic Ultra Champion in Getting Data In 04-01-2018 0 12	0	12
how do i find where each hosts are indexing data the reason for this is because someone made a mix-up on the UF and then some hosts are indexing to the wrong index. I... by ranjitbrhm1 Communicator in Getting Data In 04-01-2018 0 2	0	2
How to create a summary Index that will give license usage by index and sourcetype? Hi All, I am trying to create a summary index which will gives us the license usage by index and sourcetype, which w... by siva_cg Path Finder in Getting Data In 03-31-2018 0 4	0	4
How to assign a field alias to a json field? We have the following in props.conf - FIELDALIAS-alias1 = apiRequest.apiInfo.clientID AS clientID It doesn't seem ... by ddrillic Ultra Champion in Getting Data In 03-31-2018 0 3	0	3

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...

Build and Launch AI Agents from Your Splunk Workflows

Replay Tech Talk Build and Launch AI Agents from Your Splunk Workflows We’ve all been there: juggling ...

index This | What kind of room has no doors?

IndexEducation Cover Art Banner Cisco.png August 2026 Edition Hayyy Splunk Education Enthusiasts and the ...

Getting Data In

How to edit my configurations so that my Kubernetes host log will be reformatted entering Splunk?

How to create dump command and put datetime?

Why am I encountering an Error on forwarding nginx container logs to Splunk forwarder?

indexing congestion consistenly happening

How do you change apps in in the API (Java)?

Why are Windows event logs with MSSQLSERVER$AUDIT as source getting truncated and the message is empty?

How to monitor Active Directory changes and security events with Universal forwarder?

How to configure rsyslog so that it stores them in certain directories?

How can we view the data retention policy we have set?

Why is the Splunk Universal Forwarder sending data to wrong index and, isn't sending all records of a Catalina.out?

timestamp match is outside of the acceptable time window

Can Sysmon logs completely take the place of certain "Event Logs"?

Are there inconsistencies in behavior with the need for INDEXED_EXTRACTIONS?

Why can't the Splunk server index or show events forwarded by windows host with universal forwarder?

Why am I not getting syslogs on port 512?

How to restrict transaction to group events from the same source and the same host?

Why does Splunk always get en-GB instead of en-US on the url?

How to create an If Statement in Props.conf?

Is there a way to use some sort of regular expression with field aliases?

How can I forward data from UniversalForwarder for 2 instances?

How to redirect logs to separate indexes based on host?

Why does the csv sourcetype work for upload but not via the forwarder?

how do i find where each hosts are indexing data

How to create a summary Index that will give license usage by index and sourcetype?

How to assign a field alias to a json field?

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Build and Launch AI Agents from Your Splunk Workflows

index This | What kind of room has no doors?

Issue facing while installing Splunk Add-on for AW...

Google workspace Meet logs

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

Getting Data In

Join the Conversation