Getting Data In

Community Activity

Filter iis logs before indexing I've upgraded to Splunk 6.01 and noticed the improved handling of the windows events prior to indexing and wondered i... by trodenbaugh Explorer in Getting Data In 07-06-2017 1 20	1	20
whitelist queries HI I have a question The existing whitelist in inputs.conf includes whitelist = (tomcat\|vizql\|hs_err\|tdeserver64)-[... by athorat3 New Member in Getting Data In 07-06-2017 0 4	0	4
How do I mask a pattern using sedcmd in props.conf? How do I replace/mask the pattern below in props.conf..? pattern \"password\":\"passtest@123\" expecting \"passwo... by prakash007 Builder in Getting Data In 07-06-2017 0 8	0	8
How to parse my sample JSON using spath? I am trying to parse this json using spath, trying to create visualization from those kind of json logs. can some one... by jaireddy Engager in Getting Data In 07-06-2017 0 5	0	5
how to upload and index xml file please help me to upload xml file by aravindkg Engager in Getting Data In 07-06-2017 0 1	0	1
How to add constant to HOST name using regular expression I am using a reg-exp to set the host name from the file path e.g. \servername\logs\application\ag_clientname_log moni... by neilli Engager in Getting Data In 07-05-2017 0 2	0	2
How to replicate a particular index's indexed data to other set of indexers? We have 2 sets of Indexers in our environment. Set-1 has 29 indexers and Set-2 has 5 indexers. All the data comes to... by bharadwaja30 Path Finder in Getting Data In 07-05-2017 0 3	0	3
Sourcetypes "cross polinating" I am having an issue with Splunk where the sourcetypes are getting mixed up between actualy sources. For example I ha... by brent_weaver Builder in Getting Data In 07-05-2017 0 5	0	5
will duplicate entries of monitor statements in inputs.conf coz Logs to be indexed twice? In our inputs there are wildcard entries for directories and I recently noticed there were duplicate entries for the ... by sarnagar Contributor in Getting Data In 07-05-2017 0 1	0	1
Should each device sending data have a different UDP input port? Hello! I'm new and this is my first post here in the community. I did the Splunk installation with the purpose of te... by julianosantos New Member in Getting Data In 07-04-2017 0 2	0	2
How do I Configure a Workflow to POST JSON Encoded Data? When creating a work flow with a POST request everything is automatically URL encoded according to the docs. "Splunk... by klopez30 Explorer in Getting Data In 07-04-2017 3 2	3	2
Splunk search query/queries for populating splunk supported timezones in dropdown type input. I have several input types in my dashboard for which I have allotted different tokens. Now I have a requirement where... by waltz Explorer in Getting Data In 07-04-2017 0 8	0	8
Renaming auto extracted fields After parsing my json fields the auto extracted fields have format like this a{}.b and a{}.b{}.c and so on. When i t... by SudarshanS Explorer in Getting Data In 07-04-2017 0 5	0	5
While upgrading a setup of 2 non-pooled SH and 4 Indexer clusters to Splunk 6.6, when should I upgrade SH and Apps ? I have to upgrade 2 SH and 4 indexer clusters from Splunk 6.3 to Splunk 6.6. SearchHeads are not pooled. I'll be upgr... by abhinav_maxonic Path Finder in Getting Data In 07-04-2017 0 5	0	5
Problem indexes.conf splunkd not restarting ! Hello , I have a distributed architecture of Splunk SH with Splunk ES and an indexer . I get suddenly this error mes... by Nesrinepfe Path Finder in Getting Data In 07-04-2017 0 11	0	11
Multiple Whitelists Hi I have the following two inputs in inputs.conf. They both work separably but not together. Working [monitor:... by robertlynch2020 Influencer in Getting Data In 07-03-2017 0 3	0	3
How to configure the universal forwarder to collect System Properties on a Windows Server? How can I configure the universal forwarder to collect the hosts system properties? by jrhoads New Member in Getting Data In 07-03-2017 0 3	0	3
Complex Conditional search based on time I am a newbie in splunk and practising to learn it slowly. I have a setup where I am forwarding logs of Windows Mach... by ashutoshab Communicator in Getting Data In 07-03-2017 0 1	0	1
How to resolve error "ERROR IndexConfig - stanza=perfmon Required parameter=tstatsHomePath not configured" when starting the indexer? When using Windows 2016 Universal Forwarder 6.6.1, I'm running into issues with starting indexer. splunkd log indicat... by rakeshroberts New Member in Getting Data In 07-03-2017 0 4	0	4
How to drop log file headers before indexing? I've had a read of dropping useless headers in Splunk 6 and tried using the FIELD_HEADER_REGEX, in fact I also tried ... by gjanders SplunkTrust in Getting Data In 07-03-2017 0 4	0	4
Using Splunk as a enterprise data platform Splunk has to fit into a structured and unstructured world without duplicating effort. Splunk currently serves as a s... by lisaac Path Finder in Getting Data In 07-02-2017 0 4	0	4
Pulling data from Fluentd Plugin to Splunk, how do we transform the data to split into numerous sourcetypes? We are pulling data like Red Hat logs, Apigee, Ansible etc. from AWS through fluentd plugin which is forwarding data... by vya9836 New Member in Getting Data In 07-02-2017 0 8	0	8
Can single forwarder forward data to two different indexer's ?? Hi I am using a UF say in Machine A , its has logs at two different paths say Log Path1 and Log Path2 . Now i want t... by rakesh_498115 Motivator in Getting Data In 07-02-2017 5 9	5	9
unable to send windows events from splunk server to third party syslog server tried below configurations to forward the data from SPLUNK server to syslog server(third party) , but no data in sys... by cleelakrishna Loves-to-Learn in Getting Data In 07-02-2017 0 2	0	2
Is it possible to set a conditional timestamp from indexed events? I have an XML file with "items" that are being indexed. The issue is that these "items" can possibly have two differ... by amanno New Member in Getting Data In 07-01-2017 0 4	0	4