Getting Data In

Ask a Question

Discussions

Thread Info

Is there an app or add-on to pull Cloudflare json logs using into Splunk Cloud using a curl command?

Hi, Probably a basic question, but I have tested out manually importing json logs into Splunk using a curl command...

by New Member in

How to implement clustering and load balancing in Splunk?

Hi, This question is off-topic for Splunk, but please help me out since I need to set up the configuration urgentl...

by Path Finder in

Unable to import a file with two spaces as separator, which occur once. How to edit my transform configurations?

Hello, I'm trying to import this kind of file : \#DATE TITRE1 TITRE2 TITRE3 #LINE TO IGNORE 20170101 LIGNE1COL...

by Path Finder in

How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

Hi, I have a scheduled report which runs every midnight over last 30 days data and indexing into summary index. Bu...

by Explorer in

How to redirect some SNMP data to a new index?

We have SNMP data being sent from a heavy forwarder to our indexers into an index that we'll call cacti. We want S...

by Contributor in

Is there an alternative to Splunk Free for a distributed search POC?

Hi, I am trying a POC on my personal PC where Forwarder is on one machine (Linux)Indexer + Search Head on anoth...

by Path Finder in

How to resolve "Bad regex value" error in transforms.conf?

Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: invalid range...

by New Member in

How to construct a TIME_FORMAT that will extract the date and military time when it is separated on the same line?

I need to get a proper timestamp from raw data that looks like this: Date Of Incident: 12/02/2015 12:00:00 AM, Tim...

by Splunk Employee in

Reducing Windows Security Events flow by filtering in parsing queue

In order to filter out non-administrator logon events on WinEventLog:Security sourcetype, I inserted the following st...

by Path Finder in

Index Size : Calculate maxTotalDataSizeMB

Hello Team, I have some confusion on calculating maxTotalDataSizeMB for configuring in indexes.conf file. Below ar...

by Contributor in

Universal forwarder stopped suddenly. but not fetching the data where it got stopped after restart

hi.. in one of my windows server the universal forwarder stopped unexpected. found and restarted the universal for...

by Explorer in

Extract fields during source type creation

I have log file that has combination of plain text and key value pairs separated by "|". How can i extract all the fi...

by Explorer in

Are my props.conf and transforms.conf correct in setting metadata from TCP input?

So... I am attempting to setup a TCP input, which will automatically set metadata, from the event. The _Raw looks ...

by Explorer in

Is there any way to list all the saved searches in Splunk?

Hi Splunkers, Is there any way to list all the saved searches in Splunk? I want to export the saved searches detai...

by Explorer in

How to edit props.conf to use the "last modified" time of the file as the timestamp for each event?

I have configured monitoring for a set of files. I have configured the props.conf to use the 'last modified' time of ...

by Motivator in

Split MV into new table rows

I have rows where data looks like.. Value1^Value2^Value3Value4^Value5Value6Value7^Value8 My query (below)... s...

by Engager in

Splunk Universal Forwarder 6.4.1 and all Versions younger than 6.2 cannot be installed to 7 of our systems

The Error Message on the screen isenter code here: "UniversalForwarder Setup ended prematurely" Versions older t...

by Splunk Employee in

Why doesn't the CLI command create a stanza in inputs.conf?

Or to restate the question : Why is Splunk Web reflecting the results of the CLI command, but inputs.conf file doesn'...

by Explorer in

static csv file (uploaded only once in a day) issue

I have a csv file kept in a central path which is only uploaded once in a day. The moment i search the data on my sea...

by Path Finder in

Trying to parse my Json into a table

this is the format: { "epoch": "1485892851.94944", "id": "3952418", "name": "WMI Performance Adapter", "new_attrs"...

by Communicator in

How to resolve "error getting attributes of path "C:\pagefile.sys"" after pushing configurations to servers?

I have pushed configurations to at least 15 servers. 12 servers out of these 15 are returning with these errors, wher...

by Builder in

How to get Splunk to index a small 1.5KB CSV file?

I am trying to make Splunk read/index a CSV that is of 1.5KB. I have used the traditional CRCSALT=>SOURCE> tag in...

by Builder in

I have Windows Universal Forwarder that is sending thousands of blank Windows events and duplicating events

On the Windows client server (splunkforwarder-6.2.1-245427-x64-release.msi) the inputs.conf file contains: [WinEve...

by Path Finder in

TIME_FORMAT regex help

12/02/2015 12:00:00 AM, Execute time: 0150 looking to extract the date and the 24hr time pls

by Builder in

How to configure line breaking on TCP events separated with null character ('\x00')?

My log source generates events ended with null-character ('\x00') and sends them to Splunk via TCP in chunks every 10...

by Explorer in

Get Updates on the Splunk Community!

Getting Data In

Discussions

Is there an app or add-on to pull Cloudflare json logs using into Splunk Cloud using a curl command?

How to implement clustering and load balancing in Splunk?

Unable to import a file with two spaces as separator, which occur once. How to edit my transform configurations?

How to ensure data ingested into summary indexing through schedule reports is stored with the timestamp of the date the report is run?

How to redirect some SNMP data to a new index?

Is there an alternative to Splunk Free for a distributed search POC?

How to resolve "Bad regex value" error in transforms.conf?

How to construct a TIME_FORMAT that will extract the date and military time when it is separated on the same line?

Reducing Windows Security Events flow by filtering in parsing queue

Index Size : Calculate maxTotalDataSizeMB

Universal forwarder stopped suddenly. but not fetching the data where it got stopped after restart

Extract fields during source type creation

Are my props.conf and transforms.conf correct in setting metadata from TCP input?

Is there any way to list all the saved searches in Splunk?

How to edit props.conf to use the "last modified" time of the file as the timestamp for each event?

Split MV into new table rows

Splunk Universal Forwarder 6.4.1 and all Versions younger than 6.2 cannot be installed to 7 of our systems

Why doesn't the CLI command create a stanza in inputs.conf?

static csv file (uploaded only once in a day) issue

Trying to parse my Json into a table

How to resolve "error getting attributes of path "C:\pagefile.sys"" after pushing configurations to servers?

How to get Splunk to index a small 1.5KB CSV file?

I have Windows Universal Forwarder that is sending thousands of blank Windows events and duplicating events

TIME_FORMAT regex help

How to configure line breaking on TCP events separated with null character ('\x00')?

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Observability protocols to know about

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

GlobalMantics Dataset Query

WARN SSLCommon [53742 FwdDataReceiverThread] - Re...

What is the correct format for including the API k...

Service Principal configuration for Splunk Add-on ...

AWS VPC Flow logs getting ingested non-human reada...