Getting Data In

Community Activity

How to do new User-Setup Windows Event Logs from Universal Forwarder to Different Index? Sorry for this question as I know it is probably simple, but I can't figure it out. I have a single windows server r... by ghostdog920 Path Finder in Getting Data In 01-24-2018 0 1	0	1
Cold to frozen script, simply moving to thawed folder- how to genericize? I want to use the coldToFrozenScript to simply move from cold to my thawed path. Great, my shell script simply contai... by tedder Communicator in Getting Data In 01-24-2018 1 3	1	3
How can SEDCMD be used to extract and modify KV pairs from multiline events? Here is a sample event I am attempting to parse and substitute 'SomeData=.*Transaction Type : ' with 'TxnType=' DT=2... by crisjnelson Explorer in Getting Data In 01-24-2018 0 2	0	2
Map with inputlookup not working I have a dataset 1 like: VID A212 A213 B151 B153 Dataset 2 like: QID Solution 2145 text contains A212 2155 tex... by nsraoch1975 New Member in Getting Data In 01-24-2018 0 1	0	1
Perfmon process elapsed time not showing individual instances Inputs.conf shows: [perfmon://Process] object = Process interval = 120 counters = Elapsed Time instances = w3wp* Pe... by cn_jluke New Member in Getting Data In 01-24-2018 0 0	0	0
Correctly ingest Puma / Rails logs Hello, I have been fighting with this issue for the past few says and still cannot manage to solve it. After reading... by aa123s Explorer in Getting Data In 01-24-2018 1 4	1	4
Is it possible to have a separate log file for errors occurring only within a specific Splunk App? Hi all, I am posting this question because I was not able to find the answer so far. I know that Splunk logs a lot a... by mariasudolska New Member in Getting Data In 01-24-2018 0 2	0	2
How to add multiple json events as one array? I am getting output json like this: { "preview": false, "result": { "job": "abdghytr", "Stat... by yuvarajsap New Member in Getting Data In 01-23-2018 0 1	0	1
Mask a particular field in csv data at Index time I have a csv data that contains some sensitive information like client ip. Here is how one of the rows of the data lo... by divyanshukakwan Explorer in Getting Data In 01-23-2018 0 5	0	5
Pulling a multivalue field from a JSON array Hi, I'm trying to pull a multivalue field from a JSON array to get statistics from it. The data looks as follows: ... by brajaram Communicator in Getting Data In 01-23-2018 0 4	0	4
Creating a tabular result along with chart Hello Splunk Support Community: I am trying to find the difference between request and response from the log. For i... by babidi New Member in Getting Data In 01-23-2018 0 6	0	6
Error trying to add csv I'm trying to upload a csv file via the Upload button and when I do I get the following error "'module' object has no... by dougsummersett New Member in Getting Data In 01-23-2018 0 1	0	1
Time Comparison - Windows I am trying to compare two windows time stamps, and find out if they are more than 10 minutes apart. The time stamps ... by stakor Path Finder in Getting Data In 01-23-2018 0 3	0	3
Using Python SDK to run search against data model -- permissions issues All I'm running a query using python SDK against a data model stored in a custom app. I get the response: FATAL: Err... by himynamesdave Contributor in Getting Data In 01-23-2018 1 1	1	1
loginCustomLogo broken link Hi, has anyone ran into an issue. I accidentally didn't have the .png or .jpg in the /opt/splunk/etc/apps/search/app... by dkrichards16 Path Finder in Getting Data In 01-23-2018 0 4	0	4
Universal Forwarder - Linux server - multiple processes running Hi there, maybe a simple question for the pros. I have installed on different linux servers the UF to get logs and ... by krusty Contributor in Getting Data In 01-23-2018 0 2	0	2
Join three sources without common fields and assign one fields to other field I have three sources on same index ="test" source1 source2 ... by Mounika1025 New Member in Getting Data In 01-22-2018 0 2	0	2
How to get the job's log file from client by REST API? I made a big POST(REST API) request to "services/search/jobs" by collect with index and marker, it will return a sid.... by jenniferhao Explorer in Getting Data In 01-22-2018 0 1	0	1
Filter Windows EventCode using blacklist and Whitelist I have installed Splunk Universal Forwarder Version 6.1.1 and Indexer also on 6.1.1. I am trying to understand the ... by sat94541 Communicator in Getting Data In 01-22-2018 2 8	2	8
Why do I have fieldnames in my TSV data Hello I have configured a monitor for our TSV data but I am getting field names in the data. I believe its because ... by tkwaller_2 Communicator in Getting Data In 01-22-2018 0 1	0	1
Universal Forwarder not load balancing to indexers My environment has a few forwarders and 4 indexers, with autoLBFrequency set to 45 seconds. Forwarders' output.conf ... by splunkIT Splunk Employee in Getting Data In 01-22-2018 3 5	3	5
How to hide past events in the FIRST alert with -2h time window My alert runs at 8 AM, 10 AM, 12 PM daily when count < 500 , with a time frame of -2h@h to now. So, at 8 AM repor... by ibob0304 Communicator in Getting Data In 01-22-2018 0 1	0	1
Unable to add more sources to Universal Forwarder Hi, I'm pretty new in the Splunk field. I've installed a little environment of Splunk on virtual machine and Unive... by yossefn Path Finder in Getting Data In 01-22-2018 0 5	0	5
How to move data from one sourcetype to another sourcetype? Hi, I have sourcetype "abc" which has few days data. Now we have decided to modified the sourcetype name to def . I ... by vishal_bandavad Explorer in Getting Data In 01-22-2018 0 6	0	6
transforms.conf won't let me change the sourcetype Hi all, I've got a small problem here.. Here is the scenario: I am receiving a file from a UF which has got this f... by llacoste Path Finder in Getting Data In 01-22-2018 0 5	0	5