Getting Data In

Community Activity

How does Splunk collect data? Hello, How Splunk collect DATA??? : Does splunk copy data from machines....or it collect them and after delete dat... by hanene Explorer in Getting Data In 11-02-2017 0 5	0	5
unable to search index="_internal" for heavy forwarder instance from search head console but splunkd.log is functional Hi All, Suddenly I am unable to search the index="_internal" for all heavy forwarder instance from search head consol... by Hemnaath Motivator in Getting Data In 11-01-2017 0 3	0	3
Source vs Sourcetype: What's the difference? Source - The source of an event is the name of the file, stream, or other input from which the event originates 1) W... by test_qweqwe Builder in Getting Data In 11-01-2017 1 2	1	2
401 Disables POST, goes with GET for POST /splunkd/__raw/services/jobs We are using splunk 6.3.6 I try to perform POST through /splunkd/__raw/services/search/jobs curl -kvsL -X POST --co... by rjollet New Member in Getting Data In 11-01-2017 0 5	0	5
Parsing logs from UDP input I installed addon for my product but the problem is that the addon is intended to collect data from the file, and not... by test_qweqwe Builder in Getting Data In 10-31-2017 0 1	0	1
How does Splunk rotate indexed data (colddb, etc)? Hi, I have an index called app1 with the following configuration. [app1] coldPath = $SPLUNK_DB/app1/colddb homePath... by jackiewkc Path Finder in Getting Data In 10-31-2017 0 1	0	1
What is a summary index and how can one check whether the summary index gets the data of a particular sourcetype? My main question is I am trying to check whether the current summary indexes in our environment were getting the data... by pavanae Builder in Getting Data In 10-31-2017 0 4	0	4
Can I remove a tag from already indexed data? Is it possible to remove a tag from indexed data? Fox example if I have an app named 'TA-App' and it had a tag for #d... by mrtolu6 Path Finder in Getting Data In 10-31-2017 1 1	1	1
How do I install a universal forwarder on an IBM Logical Partition (LPAR)? How do I load the Universal Forwarder on a IBMi LPAR? by kshannon New Member in Getting Data In 10-31-2017 0 5	0	5
AND Operator in JSON I have a Log System which Logs in JSON Format Like these: {<!-- --> "API_Name": "Get ID Cards", "End Point": "/write/... by belicoff New Member in Getting Data In 10-31-2017 0 2	0	2
Configuration for heavy forwarder to store events locally when indexer is unavailable? Dears, may i know how to configure splunk Heavy forwarder to store events locally in case of indexer unavailable ? by ahmedhassanean Explorer in Getting Data In 10-31-2017 0 1	0	1
Do searches run on the search head or the indexer? I have a single Splunk instance with very high CPU workload. My investigation shows a bunch of searches are consuming... by danielwan Explorer in Getting Data In 10-30-2017 0 2	0	2
Does Splunk have an option to only index part of a JSON file? My json file is very long but most of the information in there is redundant. I just want to get all the segments that... by tamduong16 Contributor in Getting Data In 10-30-2017 0 6	0	6
What are the main differences between the Universal forwarder and Heavy forwarder? Can someone explain me in simply english the difference between there two forwards and where they are using? by test_qweqwe Builder in Getting Data In 10-30-2017 0 1	0	1
What is best process of sending logs from Splunk to syslogng server ? Hi, We are planning to forward Windows events logs from Splunk to RSA. https://answers.splunk.com/answers/581066/how-... by splunker969 Communicator in Getting Data In 10-30-2017 1 4	1	4
I need to get Windows event details index="wineventlog" sourcetype="wineventlog:security" \| search (action=failure OR action=success) \| search (EventCode... by rahul_acc_splun New Member in Getting Data In 10-30-2017 0 1	0	1
CSV lookup, search unstructured index, find matches and return the statistics I posted a comment on https://answers.splunk.com/answers/468612/how-to-search-a-lookup-table-and-return-the-matchi.ht... by msichani Explorer in Getting Data In 10-30-2017 0 4	0	4
Splunk and AIDE -- How do I ignore the first line of an AIDE log file? Right now AIDE runs a check every 5 minutes and comes back with the same results each time of files Added, Removed, o... by matthewssa Path Finder in Getting Data In 10-30-2017 0 2	0	2
New logs not feeding into Splunk I have a Red Hat server running rsyslog. Everything is logging but 1 log is not feeding into Splunk. The rsyslog.conf... by andsmith2 Explorer in Getting Data In 10-30-2017 0 9	0	9
Universal forwarder deprecated for Windows 2008 on Splunk 7.0.0? we are in the process of rolling SPLUNK to production very soon and we going with SPLUNK Enterprise 6.6.3 as we stood... by pfabrizi Path Finder in Getting Data In 10-30-2017 0 4	0	4
How to extract time log from JSON data for event _time? Team, In my JSON data, there is below line which I want to be my event time (_time). "eventDateTime" : "2017-24-08... by anantdeshpande Path Finder in Getting Data In 10-30-2017 0 2	0	2
CSV files indexing with a second structure (new header) with associated values Hi ! Currently working for a quite complex Application, i am indexing many csv files contains within Zip files. Thi... by guilmxm Influencer in Getting Data In 10-30-2017 0 5	0	5
Why isn't my data sorting in ascending order? Hi All, My dashboard is working fine and as expected for a month now. My dashboard is about incident management for ... by NicoloPunzalan2 Engager in Getting Data In 10-29-2017 0 7	0	7
Heavy forwarder not sending logs (Windows) I've got an issue with HF not sending the logs to indexer. Does anyone have experience with something like this? HF ... by hkizuka Explorer in Getting Data In 10-29-2017 0 4	0	4
Is there any advantage to sending data from universal forwarder to an intermediate heavy forwarder instead of directly to indexers? Is there any advantage to sending data from UFs to an intermediate HF instead of directly to indexers? I recall read... by packet_hunter Contributor in Getting Data In 10-29-2017 0 8	0	8