Getting Data In

Community Activity

Unable to parse key-value pair from JSON log data Hi all, I am trying to parse key-value pair from my JSON log data. I am unable to parse JSON logs into our Splunk ins... by rajnish1202 Explorer in Getting Data In 10-06-2017 0 9	0	9
Accessing bash variables via a universal forwarder scripted input When using a shell script on my splunk server I am able to access variables with no problem ie #!/bin/bash java -jar... by pholderness New Member in Getting Data In 10-06-2017 0 1	0	1
SSL Error in Splunk indexer Hi, Recently we upgraded Splunk indexer from the version 6.5.2 to 6.6.3. Now we have many SSL errors are there in lo... by RAYUDU_NARA Explorer in Getting Data In 10-05-2017 0 1	0	1
Access JSON data This is in follow-up to https://answers.splunk.com/answers/578105/help-with-search-to-access-json-data.html#comment-5... by biec1 Explorer in Getting Data In 10-05-2017 0 1	0	1
MVINDEX not working well with SPACE separated values Hello All, For an event like this - CPU uPct nPct sPct wPct iPct all 0.63 0.00 0.38 ... by mrigs New Member in Getting Data In 10-04-2017 0 4	0	4
Splunk Universal Forwarder 6.5.2 -- 100% CPU Solaris Can someone help me in resolving the issue? Splunkd Universal Forwarder is taking 100% process. I am monitoring aroun... by chintan_shah Path Finder in Getting Data In 10-04-2017 0 1	0	1
Indexer issue: problem parsing indexes.conf I'm getting this error where on the indexer Problem parsing indexes.conf: Cannot load IndexConfig: stanza=clustering... by dhotlosz Explorer in Getting Data In 10-04-2017 0 1	0	1
VM templating of Splunk instances We plan to create Splunk pre-installed virtual machine (VM) templates for internal use. We have assumed the followin... by takaakinakajima Path Finder in Getting Data In 10-04-2017 0 2	0	2
Why isn't the timestamp being recognized ? We have a case that looks like this - So, the events are not broken by the timestamp. Is it because of the undersc... by ddrillic Ultra Champion in Getting Data In 10-04-2017 0 6	0	6
When I delete an old version of Splunk does it delete the old indexes and hosts? Hi All, I've recently had to reinstall Splunk on my server. It was using an index called "index2", I've since removed... by ellissa New Member in Getting Data In 10-04-2017 0 1	0	1
How to deal with data that was uploaded twice? Hi Experts, I am now in a strange situation, we have a index in which we uploaded .csv files for every month and for... by sudarshan391 Path Finder in Getting Data In 10-04-2017 1 2	1	2
Search for a list of installed packages with version numbers for a host I've managed to create a search which will list for me all installed packages on a particular host, but I need to hav... by yrb6924 New Member in Getting Data In 10-04-2017 0 3	0	3
Windows Events Not showing Up on Indexer A UF was installed on 2 Windows domain Controllers. These are in a different windows forest than my other devices. I ... by pfabrizi Path Finder in Getting Data In 10-04-2017 0 3	0	3
Doing stats on multivalued JSON fields (mxexpand is too slow) Hi Ninjas I'm dealing with some deeply nested JSON events like: "sendTime":"2017-09-21T17:02:06.583+02:00","running... by claudio_manig Communicator in Getting Data In 10-04-2017 0 7	0	7
: skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block10 skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk s... by Mohsin123 Path Finder in Getting Data In 10-04-2017 0 1	0	1
inputs.conf stanza to monitor only current data after changes are pushed to production (ignoring historical data)? Hi All, I want to ingest the log files from an application server directory using universal forwarder. Log file nam... by newbie2tech Communicator in Getting Data In 10-04-2017 0 2	0	2
How to stop line breaking twice? First line feed is CR format and the second line feed is CRLF format In my environment the following servers exist. windows 2012 R2 Splunk 6.5.2 On this server, when trying to export lo... by yutaka1005 Builder in Getting Data In 10-04-2017 0 2	0	2
diag を生成しても、デフォルトで lookup ファイルが含まれない Splunk ver. 6.5.0 以降の Splunk サーバーで diagを生成したところ、lookup ファイルがデフォルトで diag内に見つかりません。これは製品の不具合でしょうか。 by CurryPan Communicator in Getting Data In 10-03-2017 0 2	0	2
Event data filtering working in one environment but not in other. I have two clustered environments consisting of 3 SH,3 Indexers and 1 HWF each running on Splunk 6.4.1. I need to fil... by jincy_18 Path Finder in Getting Data In 10-03-2017 0 3	0	3
Is there any reason I shouldn't edit an add-on's bin directory files? I want to add a few things to an app that sends off API commands when saved searches trigger. Basically a new field f... by thisissplunk Builder in Getting Data In 10-03-2017 0 3	0	3
Does a change to props.conf require an indexer rolling restart? I'm about to implement the change in Why isn't the timestamp being recognized ? It will be in $SPLUNK_HOME/etc/syste... by ddrillic Ultra Champion in Getting Data In 10-03-2017 0 3	0	3
CSV Searches Hello everyone. I've been reading and reading and I can not get consistent results from anything I have tried. So hop... by rlamezquita New Member in Getting Data In 10-03-2017 0 1	0	1
Trouble setting up universal forwarder for Windows Log Collection I am trying to setup my splunk enterprise 6.6.1 to be able to injest windows logs from remote pc's but not having muc... by ghostdog920 Path Finder in Getting Data In 10-03-2017 0 5	0	5
IIS Log Files parsing and Removing Load Balance Health Check I,m using the new 7.0.0 version of Splunk at my distributed installation (Indexer,Search Head) and i´m trying to pars... by felipemn New Member in Getting Data In 10-03-2017 0 2	0	2
Splunk architecture feedback Hello every body , I have to deploy 3 virtual machines to set up an architecture containing a forwarder, indexer an... by ALLIACOM New Member in Getting Data In 10-03-2017 0 5	0	5