Getting Data In

Community Activity

How to filter out only the accelerated reports in splunk ? Hi All, I need to filter out only the reports that are configured as Accelerated Reports in searches,Reports and Aler... by Hemnaath Motivator in Getting Data In 12-13-2017 0 11	0	11
Blacklist regular expression not working I want to blacklist below 2 files: op_fe-run_autostat.log op_fe-proteus_prod_archive.log here can be any number/c... by AnmolKohli Explorer in Getting Data In 12-13-2017 0 3	0	3
How can I index events with the real date while using the timestamp from the log? I have a Splunk instance in a Development & Test lab that uses what we call "repeatable time" to test software update... by ZimmermanC1 Explorer in Getting Data In 12-13-2017 0 2	0	2
http event collector in monitoring - kuberentes, not posting data Hi, I have gone through this tutorial https://www.outcoldsolutions.com/docs/monitoring-kubernetes/ for monitoring ku... by HyderAli New Member in Getting Data In 12-13-2017 0 3	0	3
Best way to extract mix of positional and kv from csv? My CSV log file has three fields that are positional followed by a variable mix of K=V pairs like so: 2017/12/11 20:... by tdotrob Engager in Getting Data In 12-13-2017 0 1	0	1
How to forward _internal to defaultGroup Hello, I have the following outputs defined on all my universal forwarders: [tcpout] defaultGroup = prod-group, vali... by ktn01 Path Finder in Getting Data In 12-13-2017 2 6	2	6
Logs with parameter INDEXED_EXTRACTIONS on UF could no be forwarded from indexer via syslog Hello splunker, I have some trouble to forward data to third-party systems via syslog. All logs are forwarded via sy... by ludoz13 Path Finder in Getting Data In 12-13-2017 1 4	1	4
Issue with log rotation We have log files that are being monitored. Log files are deleted every 1 hour. We noticed that at the time of log ro... by maniu1609 Path Finder in Getting Data In 12-13-2017 0 3	0	3
Help with regex on whitelist Hi, I need to whitelist on the following: SIPServer-RTP-Routing1-PR-001.20171212_124642_595.log Anything that has ... by a212830 Champion in Getting Data In 12-12-2017 0 4	0	4
No persistentqueue attributes in outputs.conf. How to configure data buffering on Heavy Forwarder ? I was referring to this link, https://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input to configu... by damode Motivator in Getting Data In 12-12-2017 0 6	0	6
Splunk says it has "received event for unconfigured/disabled/deleted index=", except it does exist and ends up working. What gives? Created an index on the gui just fine. Configed up the forwarder's inputs.conf and props.conf. Moved data into the mo... by thisissplunk Builder in Getting Data In 12-12-2017 0 9	0	9
Monitor mode failed silently on a group of large files. When do you switch to batch mode and how does it differ? My saml environment is one search head/indexer box, one indexer peer box and one forwarder. I placed about 30gb wort... by thisissplunk Builder in Getting Data In 12-12-2017 0 2	0	2
field extraction on index I've got 1 index and mutiple sources/sourcetypes. Is it possible to do field extractions on index level. In the field... by Mike6960 Path Finder in Getting Data In 12-12-2017 0 1	0	1
UF needs to be restarted every time to get data We have configured our UFs to send data from a particular folder. But every time the UF need to be stopped and start... by vikram_m Path Finder in Getting Data In 12-12-2017 0 2	0	2
Question on migrating a small Splunk Enterprise environment to new hardware Hi all, We have a relatively small Splunk environment that has 2 Universal forwarders and 1 Indexer on separate ser... by danielsheerin Engager in Getting Data In 12-12-2017 0 5	0	5
Can I log Exchange logs without the paid app? I would like to send Exchange logs to splunk, but I do not have the pay version of the Exchange app. What kind of fun... by msaz Path Finder in Getting Data In 12-12-2017 0 2	0	2
double indexing, does it count towards your license limit if i send all syslog data to one splunk enterprise instance to be indexed and then it is forwarded onto another splun... by riggas01 New Member in Getting Data In 12-11-2017 0 2	0	2
How can I determine the last date of an epoch time? So for the dashboard time dropdown, I want to determine whether the To: date that user select is the last date of th... by tamduong16 Contributor in Getting Data In 12-11-2017 0 2	0	2
How to index duplicate files which has different name Hello All, Is there any application or method in Splunk, where we can index the files(which has same contain) in Spl... by snehalk Communicator in Getting Data In 12-11-2017 1 3	1	3
How to capture snmp traps in splunk ? Hi All, I have told to configure one of the Heavy forwarder instance to receive and index the CISCO prime traps. i ha... by Hemnaath Motivator in Getting Data In 12-10-2017 0 11	0	11
how does UF handle both metrics and event data I have my UF and indexer set up and what I want to do is sending both metrics and event data from UF to indexer. from... by junyuw Splunk Employee in Getting Data In 12-09-2017 0 1	0	1
Why isn't this data indexing? Hello all, I am trying to filter the data to be indexed however not success. Nothing is indexed. I have the below l... by danillopavan Communicator in Getting Data In 12-09-2017 0 3	0	3
How to write the transforms.conf for varying password lengths Hello, Since i am new to Splunk, i'm having hard time understanding and writing the transforms for varying password ... by kteng2024 Path Finder in Getting Data In 12-08-2017 0 2	0	2
Can outputs.conf be reloaded without restarting splunk Is there a rest or sysinternal command that can be executed that will reload outputs.conf. by kbecker Communicator in Getting Data In 12-08-2017 0 4	0	4
How to skip Splunk license agreement page on Containerise the splunk? I have created a Dockerfile when the container build during that time I need to create multiple login users on backsi... by gugan Engager in Getting Data In 12-08-2017 0 2	0	2