Getting Data In

Community Activity

Will Splunk become an Output Provider for Microsoft EventFlow? Microsoft has a really slick new event routing solution that we are using in our Service Fabric distributed applicati... by RhinoTX Explorer in Getting Data In 04-25-2017 1 6	1	6
Can't manage the data that is getting forwarded to my Splunk Instance Hello, a forwarder has been set up to send data to my linux machine and I get the data, everything is fine so far. T... by ckunath Communicator in Getting Data In 04-25-2017 0 3	0	3
What are the best searches to monitor data flow activity from the Universal Forwarder to the Heavy Forwarder to the indexer? Hi , i would like to monitor the Splunk data flow activity. what are the best Splunk searches to monitor the data s... by svemurilv Path Finder in Getting Data In 04-24-2017 0 3	0	3
Heavy forwarder not doing load balancing properly I am forwarding data of one log file from 1 Heavy Forwarder to 2 Indexers. But the heavy forwarder is sending data on... by abhinav_maxonic Path Finder in Getting Data In 04-23-2017 1 8	1	8
After installing universal forwarder, why am I getting an error "you currently don't have any forwarders installed" in Splunk Cloud? I'm following "Forward data to Splunk Cloud from Microsoft Windows" document ( http://docs.splunk.com/Documentation/S... by ptur Path Finder in Getting Data In 04-23-2017 0 1	0	1
My Windows Event Log size increased dramatically after being forwarded to Splunk. Is there a way to reduce the volume of data received by Splunk? I configured a Windows 2012 server to forward AD event logs to Splunk, everything is working well except for the volu... by cowlthrpdx New Member in Getting Data In 04-23-2017 0 3	0	3
Override hostname to FQDN in etc/system/local/inputs.conf on Windows Forwarder v6.5 Hello, I need to set Windows forwarders to use the FQDN as the hostname across all inputs, as I have duplicate hostn... by kltest Explorer in Getting Data In 04-22-2017 2 5	2	5
How to skip reindexing events of manually edited JSON Hi Splunkers, I need to test folder monitoring inputs with source in JSON format. Since I'm not able to test it wit... by evelenke Contributor in Getting Data In 04-22-2017 0 17	0	17
How to add input data to Splunk forwarder from UI ? I used to update the inputs.conf for ingesting new folders and logs in splunk forwareder, but is there a way to add d... by ibob0304 Communicator in Getting Data In 04-21-2017 0 4	0	4
Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application? Does Splunk's Universal Forwarder supports SSL for TCP inputs (i.e It is receiving data from external application)? D... by ankithreddy777 Contributor in Getting Data In 04-21-2017 0 5	0	5
How to edit my configurations to encode French special characters (é à ê è)? Hi, I am importing data from Gitlab to Splunk. The data imported are in French and contains special characters like ... by Naaba New Member in Getting Data In 04-21-2017 0 4	0	4
After installing universal forwarders, why am I getting error "you currently don't have any forwarders installed" for Add Data in Splunk Web? Hi all; I'm installing a universal forwarder on my Linux and Windows machines. After that, I'm starting to get the d... by sayz Path Finder in Getting Data In 04-21-2017 1 13	1	13
fill an occasional Null field with the current time I have a search outputting results which includes a field for 'closedtime'. On occasion however this field will be bl... by jacqu3sy Path Finder in Getting Data In 04-21-2017 0 6	0	6
Configure timestamp based only on Month and Year Hello, I have a problem to configure the timestamp on one of my source CSV file. In this file, I have a column con... by MaximeMouquet Explorer in Getting Data In 04-21-2017 3 6	3	6
How to edit props.conf and transforms.conf on a heavy forwarder to keep specific events and discard the rest props.conf [firewall] TRANSFORMS-set = setnull,setparsing transforms.conf [setnull] REGEX = . DEST_KEY = queue FO... by merrelr Path Finder in Getting Data In 04-21-2017 0 7	0	7
Deploying SPLUNK for Active Directory Auditing I am very new to SPLUNK, If some one could help me on 2 issues I am having with Deploying Splunk for Active Directory... by splunk_sa Explorer in Getting Data In 04-21-2017 0 3	0	3
How to send Cisco ASA Firewall logs to syslog-ng server and push it out to the indexer with universal forwarder Hi Guys, I've been trying to send Cisco ASA firewall logs to syslog-ng server where the forwarder is installed but ... by jhl226116 Explorer in Getting Data In 04-21-2017 0 24	0	24
How to monitor a log file on UNIX where file name has date and PID which which are not static all the time.? Hi Team, My file name looks like below: SASMeta_MetadataServer_2017-04-21_auq4066l_9175164.log <-----constant------... by rohithmn3 New Member in Getting Data In 04-20-2017 0 3	0	3
Why is the event timestamp and the timestamp within my results different depending on the search? My event timestamp and timestamp within my results are not same while i am searching in Splunk Web but some scenarios... by karthi2809 Builder in Getting Data In 04-20-2017 0 2	0	2
Can data being sent from a Universal Forwarder be filtered at the indexer level for only certain events? We have a Universal Forwarder that is sending a huge amount of data. We need to only index events that contain any of... by riotto Path Finder in Getting Data In 04-20-2017 0 8	0	8
Is it possible to automatically run iplocation on a client ip for a given sourcetype? I want to run iplocation client_ip for a given sourcetype automatically. For example if i run I dont want to run th... by theeansible Path Finder in Getting Data In 04-20-2017 0 2	0	2
Index /var/log even though Splunk doesn't run on root Hello Splunkers, So our Splunk Enterprise runs on a non-root user and our requirement is to forward /var/log/secure... by lloydknight Builder in Getting Data In 04-20-2017 0 3	0	3
How to get data from host to heavy forwarder to indexer? I have an indexer, search head, heavy forwarder and license master server configured. I also have a test server (host... by mrkris82 New Member in Getting Data In 04-20-2017 0 2	0	2
Search Archived Buckets in Hadoop I'm working on pushing out Hadoop data roll for archived data to our index cluster. The buckets are rolling as expect... by Kieffer87 Communicator in Getting Data In 04-20-2017 0 4	0	4
How to automatically extract key value pairs after using translatefix I have used translatefix to decode the fix messages logs and it worked fine. But Splunk is not able to automatically ... by isha_rastogi Path Finder in Getting Data In 04-20-2017 0 6	0	6

Get Updates on the Splunk Community!

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Introducing ITSI 5.0: Unified Visibility and Actionable Insights Tuesday, July 21, 2026 | 10:00AM PT / ...

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

Inside Splunk Agent Observability:Understanding Agent Behavior, Tokens & Costs Thursday, August 06, ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Getting Data In

Will Splunk become an Output Provider for Microsoft EventFlow?

Can't manage the data that is getting forwarded to my Splunk Instance

What are the best searches to monitor data flow activity from the Universal Forwarder to the Heavy Forwarder to the indexer?

Heavy forwarder not doing load balancing properly

After installing universal forwarder, why am I getting an error "you currently don't have any forwarders installed" in Splunk Cloud?

My Windows Event Log size increased dramatically after being forwarded to Splunk. Is there a way to reduce the volume of data received by Splunk?

Override hostname to FQDN in etc/system/local/inputs.conf on Windows Forwarder v6.5

How to skip reindexing events of manually edited JSON

How to add input data to Splunk forwarder from UI ?

Does Splunk support two-way SSL between the Universal Forwarder TCP port and external application?

How to edit my configurations to encode French special characters (é à ê è)?

After installing universal forwarders, why am I getting error "you currently don't have any forwarders installed" for Add Data in Splunk Web?

fill an occasional Null field with the current time

Configure timestamp based only on Month and Year

How to edit props.conf and transforms.conf on a heavy forwarder to keep specific events and discard the rest

Deploying SPLUNK for Active Directory Auditing

How to send Cisco ASA Firewall logs to syslog-ng server and push it out to the indexer with universal forwarder

How to monitor a log file on UNIX where file name has date and PID which which are not static all the time.?

Why is the event timestamp and the timestamp within my results different depending on the search?

Can data being sent from a Universal Forwarder be filtered at the indexer level for only certain events?

Is it possible to automatically run iplocation on a client ip for a given sourcetype?

Index /var/log even though Splunk doesn't run on root

How to get data from host to heavy forwarder to indexer?

Search Archived Buckets in Hadoop

How to automatically extract key value pairs after using translatefix

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

How to integrate threat armor with splunk?

How to integrate Google Cloud armor with splunk?

Getting Data In

Join the Conversation