Getting Data In

Community Activity

Why am I getting an error when sending logs from universal forwarder to heavy forwarder? Hello, I have some windows systems that I'm trying to send logs from via a universal forwarder, to a heavy forwarder.... by slee75 New Member in Getting Data In 02-08-2018 0 1	0	1
How to configure the inputs.conf to only allow specific event IDs and only filter on a wildcard username? Hi fellas, Testing the product out. Have 2012 DC --> UF --> Splunk test environment I've figured out how to configu... by catsmeowor Explorer in Getting Data In 02-08-2018 0 3	0	3
How to re-index data in a different index? I am trying to forward a csv file to a new index. However, I found that it has already been forwarded to another inde... by matstap Communicator in Getting Data In 02-08-2018 1 6	1	6
Timestamp not being recognized in CSV Searching for the other answer, I believe this is one of the most common questions, but I couldn't figure out my answ... by skgbanga New Member in Getting Data In 02-08-2018 0 10	0	10
MIssing events from Universal Fowarder I know this question has been asked many times, but the answers dont seem to help my situation. I am running SUF on... by ArmbrusterC Explorer in Getting Data In 02-08-2018 0 7	0	7
Urgent: indexes.conf Could someone tell me where can I find indexes.conf ? Thanks in advance. by ponto New Member in Getting Data In 02-08-2018 0 4	0	4
Load Balancing at UF to HF We have the current infrastructure : UF -> HF -> Indexers Can i set up Load Balancing at the outputs.conf so that ... by vr2312 Builder in Getting Data In 02-08-2018 0 9	0	9
Why is there an export Error in .csv Alternative row and why is it blank in .csv exported results? Hi All, We have observed whenever we are exporting search results in .csv format in the results alternative rows wil... by nnimbe1 Path Finder in Getting Data In 02-08-2018 0 1	0	1
Transforms.conf to props.conf? I created a new app named sample_app_1. Inside my new app's local folder i created a transforms.conf that will be cal... by patricianaguit Explorer in Getting Data In 02-08-2018 0 7	0	7
monitor cisco switch environment I would like to monitor about 15 cisco devicces on my network. 3 ASA devices, 4 l3 switches and the rest are L2 swit... by kschoeck Engager in Getting Data In 02-07-2018 1 5	1	5
Indexing Kaspersky Logs Need help to monitor event logs from Kaspersky Security Centre in #Splunk. Merely pointing forwarder to collect Windo... by miteshvohra Contributor in Getting Data In 02-07-2018 0 21	0	21
How can I transfer logs of a sever to an indexer? I have created an index A for server X and I have done all the required setting in the inputs.conf file of server X. ... by Utkarsh_Singh New Member in Getting Data In 02-07-2018 0 6	0	6
How to do event linebreaking and timestamp recognition in header lines without timestamp information! Hi Folks, I am adding data from a log file with filename: server_zmslx1xt1119.log For the timestamp, first 7 lines ... by smdasim Explorer in Getting Data In 02-07-2018 0 4	0	4
How to extract my event in index time using props.conf and transforms.conf? How to extract my event in index time using props.conf and transform .conf? How to extract by event in index time to... by karthi2809 Builder in Getting Data In 02-07-2018 0 5	0	5
Can you index evtx on linux heavy forwarder? 4.3 Does not make it clear here: http://splunk-base.splunk.com/answers/141/can-splunk-index-windows-event-logevtevtx-fil... by r999 Path Finder in Getting Data In 02-07-2018 1 9	1	9
We are receiving _internal logs from universal forwarders but we are not receiving data from indexes which are created externally??? Universal forwarder sending data _internal logs and we are receiving those logs and appeared on search heads. But w... by saisrujan28 Explorer in Getting Data In 02-07-2018 0 4	0	4
How can I grab the latest source from a csv file, ranging from the earliest to anything within 5 minutes of that time? I have splunk import a csv file every time it's changed. Splunk imports each line of the csv file as an event. I ha... by chadman Path Finder in Getting Data In 02-07-2018 0 1	0	1
How to EXTRACT regex expression in props.conf? I have this file with this appearance first.prop.one=1 first.prop.two=2 first.prop.third=3 I was using KV_MODE=Aut... by greggz Communicator in Getting Data In 02-07-2018 0 3	0	3
How to push *.conf to universal forwarders? I've got my Universal Forwarder doing indexing on some data sources for my Splunk instance. After spending some time ... by DUThibault Contributor in Getting Data In 02-07-2018 0 3	0	3
ActiveSync Logs from Office365? How are people grabbing ActiveSync logs out of Office365 into Splunk? I do not believe that these are coming through ... by jnowotny Engager in Getting Data In 02-07-2018 0 0	0	0
Deployment server app inputs.conf vs Forwarder inputs.conf I have updated an app inputs.conf (/opt/splunk/splunkforwarder/etc/apps/inputs_prod/local) in one of my Universal For... by rchittip Path Finder in Getting Data In 02-07-2018 0 2	0	2
Can I Splunk my wtmp files? The file /var/log/wtmp is where most *nix systems keep track of all logins and logouts to the system. The file is no... by hexx Splunk Employee in Getting Data In 02-07-2018 6 3	6	3
splunkd: error while loading shared libraries: ld-linux-armhf.so.3 Hi I have a Synology NAS (RS212) with an ARM Processor (mv6282) but I can't get the ARM Forwarder to work. I get the... by hgehrts_splunk Splunk Employee in Getting Data In 02-07-2018 0 1	0	1
How to truncate events in SplunkWeb Hello, I have an unusual requirement for Splunk. I have a source that returns error messages from Java applications.... by mihenn Path Finder in Getting Data In 02-07-2018 0 0	0	0
Joining two csv files Hi, I have two CSV files that I want to be joined ex. file1 and file2 there are values in file2 which do not have a m... by mjlsnombrado Communicator in Getting Data In 02-06-2018 0 1	0	1