Getting Data In

Community Activity

Can we install a universal forwarder on a 2016 Windows server with SCCM? Is it possible to get a UF installed on a 2016 Windows server with sccm or do we have to use a chef recipe? by jdomin30 New Member in Getting Data In 11-13-2017 0 1	0	1
How do you convert an indexer into a heavy forwarder? Hello all, We are replacing our single Splunk indexer with a pair of new indexers and have migrated all the indexes ... by PCT80000 Explorer in Getting Data In 11-13-2017 0 10	0	10
Json file loading and indexing Hi all, I am trying to load and index a json file with the FREE version of SPLUNK. After loaded the file I cannot se... by erra27372 New Member in Getting Data In 11-13-2017 0 2	0	2
Some files are not being indexed Hi, I configured inputs.conf to monitor a directory. All the files in the directory were not ingested to Splunk. Som... by cchange Path Finder in Getting Data In 11-12-2017 0 5	0	5
Active Directory Password Expiry x2 index="msad" (objectCategory="CN=Person*" AND userAccountControl!=514) \| dedup displayName \| eval DateLastChanged =... by test_qweqwe Builder in Getting Data In 11-12-2017 0 1	0	1
Is there a need for for the status command when stopping a forwarder? When stopping a forwarder I see the following - bash-3.2$ ./splunk stop splunkd is not running. bash-3.2$ ./splunk s... by ddrillic Ultra Champion in Getting Data In 11-11-2017 0 2	0	2
How would you tackle Apache Logging Cleanup Help? Morning, So we have about 100 application stacks. Many of them are fronted by various versions of Apache(httpd). Un... by daniel333 Builder in Getting Data In 11-11-2017 0 1	0	1
Splunk search doesn't extract fields on the forwarded data Our forwarder sends the data to the Splunk Server & our config in the Splunk Server & forwarder looks like below. For... by kpragasam New Member in Getting Data In 11-10-2017 0 4	0	4
Set index time settings (timestamp, linebreak etc) for sourcetype set by transforms Hi Ninjas Im struggling with the following scenario: I have a heavy forwarder whos collecting a merged data stream ... by salem34 Path Finder in Getting Data In 11-10-2017 0 1	0	1
need help in formatting the data Hello All, i'm trying to format the "json" formatted data with a custom sourcetype. below are my sample events {"fo... by saifuddin9122 Path Finder in Getting Data In 11-10-2017 0 3	0	3
For some reason, Splunk has started to swap the date format for these servers The data is being imported, but it is going into splunk as the 11th September, rather than the 9th October. For some reason, Splunk has started to swap the date format for these servers The data is being imported, but it is g... by numbpulse New Member in Getting Data In 11-10-2017 0 1	0	1
Mixed single-line and multi-line events in heavy forwarder problem I have a heavy forwarder (Splunk Enterprise 7.0) that needs to parse a very nasty log file. I am interested in only a... by floko Explorer in Getting Data In 11-10-2017 0 2	0	2
Splunk Enterprise trial - Http Event Collector not working I've installed the splunk enterprise trial. i've enabled the HEC feature as described here http://dev.splunk.com/view... by henbarlevi Engager in Getting Data In 11-10-2017 1 1	1	1
Cisco Firepower Systems (FTD) . Any ready made addons/TA available? I'm not a network expert, but one of the queries came from client is to onboard Cisco FTD devices (FTD 41x series). G... by koshyk Super Champion in Getting Data In 11-10-2017 0 2	0	2
How to parse multi-line mixed messages from rsyslog? How to parse multi-line mixed messages from rsyslog? There are a lot of data from lot of applications comming from Do... by Rialf1959 Explorer in Getting Data In 11-09-2017 0 2	0	2
do you need to restart splunkd if I modify the add/remove peer node from a search cluster or indexer cluster? If I add or remove a peer node into/from a existing search head cluster or indexer cluster, do I need to restart splu... by danielwan Explorer in Getting Data In 11-09-2017 0 2	0	2
oneshot and delete re-index duplicate data help Hi, I have this file path source specified in the main index that i want to re-index everything collected into a ne... by 5plunked Explorer in Getting Data In 11-09-2017 0 4	0	4
Take only selected parts of a Windows Event Log Windows event logs have a habit of repeating key/value pairs e.g. 11/08/2017 02:29:59 PM LogName=Security SourceNam... by mooree Path Finder in Getting Data In 11-09-2017 0 1	0	1
Splunk Input List of All accepted Default Time Formats Is there a document or configuration file that spells out all of the accepted default time formats on input. In other... by reed_kelly Contributor in Getting Data In 11-09-2017 0 1	0	1
How to use a lookup without exact match (between values) Hi all, I have created a query that uses a couple of input lookups. \| inputlookup CSC_value \| lookup CSC_posture_na... by rheylen New Member in Getting Data In 11-09-2017 0 2	0	2
How to add Cisco Meraki syslog data to Splunk I have tried to add syslog data via my Meraki MX60W, but so far it is not working. Please see the attachment for how ... by cdaviso1 New Member in Getting Data In 11-09-2017 0 1	0	1
Shell script execution after a search and outputcsv Hi, I'm trying to run the following query: index=alerts Status="Open" AlertId="30822ac3b4a6138de30c5726e2e05931"\|tabl... by plongpre Engager in Getting Data In 11-09-2017 0 2	0	2
How to install an indexer and search head? Need to install Indexer and search head Is the installation of an indexer just a full installation or is there a sp... by jeeevananand New Member in Getting Data In 11-09-2017 0 5	0	5
Is there a way to only get the response with "isDone" using the REST endpoint "search/jobs/{search_id}:"? HI , When I try to get the status of the search_id using the REST endpoint "search/jobs/{search_id}: ", I see a lot... by Kukkadapu Path Finder in Getting Data In 11-08-2017 0 2	0	2
Not able to see the syslogs of ASA on Splunk Web Hi All, I've configured my ASA to send syslog to splunk server installed on centos. I took capture on ASA and I can ... by dineshverma New Member in Getting Data In 11-08-2017 0 2	0	2