Getting Data In

Community Activity

Extracting date from file name via custom datetime.xml not working... All, Here is the file name and my datetime.xml config. When I apply this and try to import the data, Splunk gets stu... by sf-mike Splunk Employee in Getting Data In 09-17-2017 1 5	1	5
Where do I edit props.conf in a cluster? If I'm using an index time props.conf setting (in this case SEDCMD) do I edit props.conf on the master or do I have t... by stevennoble Explorer in Getting Data In 09-17-2017 1 4	1	4
Will the configuration for indexes created on Search Heads be reflected in indexers? We have a indexer cluster{10 indexers] in our environment, and 2 search heads. If we create indexes on a search head... by arpit_1210 Explorer in Getting Data In 09-17-2017 0 2	0	2
Why is my sourcetype on the indexer when I import a JSON file? I am trying to import JSON file on Splunk Enterprise, my sourcetype is below: CHARSET=UTF-8 INDEXED_EXTRACTIONS=jso... by younes17 Explorer in Getting Data In 09-16-2017 1 3	1	3
Data is sent to main index only - RESOLVED in system/local directory below is the configuration. [monitor:\{Log Location}] sourcetype=test index=chilqa disable... by vikram_m Path Finder in Getting Data In 09-15-2017 0 9	0	9
Can I change the management port 8089 on only the vCenter universal forwarders? Hi - I've seen various discussions on this topic, namely 8089 used by vCenter as well as SPLUNK's deployment server b... by mvjaarsveldt Engager in Getting Data In 09-15-2017 0 1	0	1
Is it possible to set a timestamp to year value only? Hey everyone, i know Splunk is only for machine data, but I was trying to use it for some other non-machine data that... by franciscog Engager in Getting Data In 09-15-2017 0 3	0	3
Universal forwarder stopped sending data after a reinstall We were facing issue in Splunk log forwarding to IDXer cluster. I found that our enterprise instance servers are 6.5... by vikram_m Path Finder in Getting Data In 09-15-2017 0 5	0	5
Migrating Splunk Enterprise from one machine to other Hi, I need to migrate Splunk Enterprise from one machine to other machine. Currently I am running Splunk 6.4 and wan... by chintan_shah Path Finder in Getting Data In 09-15-2017 0 4	0	4
Trying to capture cisco syslog errors I just installed Splunk, and pointed my Cisco switch and router at the Splunk server IP, and told the server to liste... by wingnut144 New Member in Getting Data In 09-15-2017 0 5	0	5
How can it be that a source type in use isn't listed in Settings: (Data) Source types? We have a single Splunk instance (the server) with a number of Forwarders on remote machines (the clients). I've inst... by DUThibault Contributor in Getting Data In 09-15-2017 0 2	0	2
How to detect users using DNS different than organization DNS Dear All Good Day I need search detect users using DNS different than Organization DNS. Please share me your ideas ... by abdallahalhabba New Member in Getting Data In 09-14-2017 0 2	0	2
What happens when I update maxTotalDataSizeMB in a live environment Hi guys, We are running a multi site index cluster with 12 indexers (6 across 2 sites). Our goal is to limit the si... by Robbie1194 Communicator in Getting Data In 09-14-2017 0 3	0	3
Uploaded a large dataset (CSV file) and the data is not displaying correctly Hi I have upload a CSV file with a lot of data. In one of the column value about more then 1000 characters (with spe... by shukan Explorer in Getting Data In 09-14-2017 0 2	0	2
How to "correct before midnight"? My Splunk installation has indexed some files that weren't supposed to be indexed (dot files created by rsync), and n... by seriea Engager in Getting Data In 09-14-2017 6 12	6	12
How can I improve my search performance? (I think time conversion is why my search is slow) I'm running the following query: index=ironstream MFSOURCETYPE=SMF110 SAPPLID=CSFBTP* \| bin _time span=1d \| eval c... by szimmer661 Explorer in Getting Data In 09-14-2017 0 2	0	2
-0500 ERROR TcpOutputFd - Read error. Connection reset by peer. not not able to forward data into index $ tail -f splunkd.log 06-19-2017 06:08:12.823 -0500 ERROR TcpOutputFd - Read error. Connection reset by peer 06-19-20... by rhirasin Engager in Getting Data In 09-14-2017 0 7	0	7
Where can I find the complete documentation of configuration options for universal forwarder? In the Forwarder manual (http://docs.splunk.com/Documentation/Forwarder/6.6.3/Forwarder/Abouttheuniversalforwarder), ... by wdeng New Member in Getting Data In 09-14-2017 0 4	0	4
Create Table from json data Hi I have a json input that has the following format: {<!-- --> "body": {<!-- --> "1": {<!-- --> "dataId": 1, "first": "Mi... by chris Motivator in Getting Data In 09-14-2017 0 10	0	10
Looking for network traffic from a list of domain names in firewall traffic that only has IP addresses. I have a csv file with domain names. I need to search my firewall traffic to see if any traffic matches to/from any o... by jon_d_irish_ctr Path Finder in Getting Data In 09-14-2017 0 21	0	21
Problem filtering with props.conf and transform.conf Hi, I parsed a lot of post on splunk answers, but I still have a problem to filter a specific sourcetype. Here the... by o_calmels Communicator in Getting Data In 09-14-2017 0 3	0	3
FREE Splunk that permits up to 500MB volume per day. How do I obtain this? Hello! How do I obtain a free version of Splunk that permits up to 500MB volume per day maximum? Is this something ... by agoktas Communicator in Getting Data In 09-13-2017 0 1	0	1
How can I use a CSV of email addresses to search indexed data? Hi everyone, I'm having a little trouble querying with a CSV and wondered if you could provide assistance. I have a... by swright95 New Member in Getting Data In 09-13-2017 0 1	0	1
Where does props.conf need to exist in a distributed deployment? I think I need to push this from the deployment to each device or at least the forwarder and search head. I have 5 s... by pfabrizi Path Finder in Getting Data In 09-13-2017 0 2	0	2
Are there any apps for Apache and/or Tomcat? Hi Guys,looking for any app that deals with Tomcat and Apache. by Kirantcs Path Finder in Getting Data In 09-13-2017 0 4	0	4