Getting Data In

Community Activity

I have just installed Splunk (Windows - 64-bits), and when it tries to start Splunk, it returns the following error: "HTTP 404 Not Found". The web page that is trying to open is "http://localhost:8000/". Could you tell me what web page I have to open? I have just installed Splunk (Windows - 64-bits), and when it tries to start Splunk, it returns the following error: ... by LUIS3802 New Member in Getting Data In 03-15-2017 0 16	0	16
For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI? Hello Is it possible to specify an index when you install an universal forwarder for perfmon's metrics or after with... by nbouchia New Member in Getting Data In 03-15-2017 0 7	0	7
The timezone for Turkey will stay at the Daylight Saving Time of UTC/GMT +03:00. What can be carried out in Splunk so this timezone is picked up. In Turkey, the clock is no longer going back during the Winter months the timezone will always be: GMT +03:00 [ht... by christopherr_sp Splunk Employee in Getting Data In 03-15-2017 0 1	0	1
How can I parse XML with multivalue fields? Here's a small snippet of an xml firewall event i'm trying to parse: <response status="success"> <result> ... by wcooper003 Communicator in Getting Data In 03-14-2017 0 4	0	4
What is the correct earliest_time format for searches when programmatically querying Splunk? I'm using Python SDK (or some other client) to query Splunk and its not accepting my date format. What is the correc... by the_wolverine Champion in Getting Data In 03-14-2017 1 2	1	2
Comparing CSVs day over day in Splunk? All, I am reading in a CSV daily into index=main. It will have about 100k items in it. I want an alert for any adde... by daniel333 Builder in Getting Data In 03-14-2017 0 2	0	2
How to correctly set splunktcpin queue size on indexers? Hi, How to correctly set splunktcpin queue size on indexers? I tried: in server.conf: [queue] maxSize = 2MB in ... by lukasz92 Communicator in Getting Data In 03-14-2017 0 2	0	2
Why is my blacklist regular expression not working? Watching: /var/log (across 6 servers) Blacklist: (audit\|(\.gz$)) Result: still uploads at least a gig of /var/log... by arohde New Member in Getting Data In 03-14-2017 0 4	0	4
Index all but one input Guys- I'm facing an (apparantely) challenging task: I have a standalon splunk test instance which serves as a first ... by claudio_manig Communicator in Getting Data In 03-14-2017 0 2	0	2
Is configuration bundle used to remove an app or add-on? We are moving to a new Anti-Virus vendor and I will need to add the add-on (TA) for the new vendor. My question conc... by scottrunyon Contributor in Getting Data In 03-14-2017 0 1	0	1
After upgrading to 6.5.0, why is there a runaway splunkd process using up an entire CPU? After upgrading to 6.5.0 from 6.4.3 on RHEL5 x86_64-bit, we're noticing a single runway splunkd process chewing up an... by rgiles Engager in Getting Data In 03-14-2017 1 5	1	5
How to correlate Windows Events by Logon_ID field? I am trying to find a way to correlate two Windows events together to detect a few forms of lateral movement. The ca... by aqstevens New Member in Getting Data In 03-14-2017 0 3	0	3
How to avoid indexing events twice when applying crcSalt= Hello We are indexing a file structure like /opt/logs////. with YYYY=year, MM=month and DD=day. So far, we have not... by langhorn Explorer in Getting Data In 03-14-2017 1 5	1	5
How to prevent error "Bug during applyPendingMetadata, header processor does not own the indexed extractions confs." Hi, We are seeing lots of the following errors on our forwarders: 11-21-2016 06:23:13.425 +0100 ERROR TailReader - ... by krdo Communicator in Getting Data In 03-13-2017 0 5	0	5
Management Console - Indexing Performance shows Queue Fill Ratio's are at 100% (almost) We have a multi-site cluster and I started noticing in DMC that some of the Queue Fill Ratio's are almost at 100%. Wh... by jagadeeshm Contributor in Getting Data In 03-13-2017 1 1	1	1
Why is my nested JSON event not formatted correctly? Can Splunk be configured to allow for interpreting JSON objects with multiple-levels of depth? Here's an example: {... by Branden Builder in Getting Data In 03-13-2017 0 8	0	8
In my Splunk developed app, everything works fine on Linux, but why is an extra line added to the beginning of all config files on Windows? Hi everyone, I am currently facing the following problem: In my Splunk developed APP, on Linux everything seems to b... by mostafaelsaie New Member in Getting Data In 03-13-2017 0 4	0	4
Why are my inputs for Windows Network Performance Monitoring counters not working? Hi all, We're trying to get data from Windows network perfmon counters using the Splunk Universal Forwarder + Data I... by maffreitas Path Finder in Getting Data In 03-13-2017 0 5	0	5
Where does splunk store the notable events logs and how to know the retention period for the same? Where does splunk store the notable events logs and how to know the retention period for the same? by faisal_saifi New Member in Getting Data In 03-13-2017 0 10	0	10
How to figure out index disk space footprint on indexers? I was struggling to find short and long term estimations on how much space was taken by each index in each state, so ... by EdgarAllenProse Path Finder in Getting Data In 03-13-2017 4 1	4	1
Is it advisable to deploy heavy forwarders vs universal forwarders to clients? Is it advisable to deploy heavy forwarders to all clients vs universal forwarders? We have an interest in cutting do... by thomas_forbes Communicator in Getting Data In 03-13-2017 0 10	0	10
Why did my indexers have a large spike in io? Hi Folks; Wondering if someone could help me out here. I just had a big issue with Splunk. 3 of my Indexers just c... by paimonsoror Builder in Getting Data In 03-12-2017 0 7	0	7
Splunk 6.5.2: Why am I unable to add data via HTTP Event Collector? Working with Splunk 6.5.2. Using following curl command data ingestion fails: $ curl -k https://localhost:8088/serv... by phagunbaya Explorer in Getting Data In 03-12-2017 1 3	1	3
How to parse the British Pound £ sign for currency fields? Hi, I'm relatively new to Splunk and trying to ingest a cav of transactions in GBP in the format £123.45. I have the... by splunkuser_uk New Member in Getting Data In 03-12-2017 0 4	0	4
Is it safe to use a 6.5.2 universal forwarder with a 6.5.1 indexer? I would like to deploy the latest 64-bit Windows forwarder (6.5.2) but we are still at 6.5.1 for our indexers. by broomejohnp New Member in Getting Data In 03-12-2017 0 4	0	4

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Getting Data In

I have just installed Splunk (Windows - 64-bits), and when it tries to start Splunk, it returns the following error: "HTTP 404 Not Found". The web page that is trying to open is "http://localhost:8000/". Could you tell me what web page I have to open?

For perfmon metrics, is it possible to specify an index at universal forwarder installation time or after installation with the CLI?

The timezone for Turkey will stay at the Daylight Saving Time of UTC/GMT +03:00. What can be carried out in Splunk so this timezone is picked up.

How can I parse XML with multivalue fields?

What is the correct earliest_time format for searches when programmatically querying Splunk?

Comparing CSVs day over day in Splunk?

How to correctly set splunktcpin queue size on indexers?

Why is my blacklist regular expression not working?

Index all but one input

Is configuration bundle used to remove an app or add-on?

After upgrading to 6.5.0, why is there a runaway splunkd process using up an entire CPU?

How to correlate Windows Events by Logon_ID field?

How to avoid indexing events twice when applying crcSalt=

How to prevent error "Bug during applyPendingMetadata, header processor does not own the indexed extractions confs."

Management Console - Indexing Performance shows Queue Fill Ratio's are at 100% (almost)

Why is my nested JSON event not formatted correctly?

In my Splunk developed app, everything works fine on Linux, but why is an extra line added to the beginning of all config files on Windows?

Why are my inputs for Windows Network Performance Monitoring counters not working?

Where does splunk store the notable events logs and how to know the retention period for the same?

How to figure out index disk space footprint on indexers?

Is it advisable to deploy heavy forwarders vs universal forwarders to clients?

Why did my indexers have a large spike in io?

Splunk 6.5.2: Why am I unable to add data via HTTP Event Collector?

How to parse the British Pound £ sign for currency fields?

Is it safe to use a 6.5.2 universal forwarder with a 6.5.1 indexer?

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Quick connection discovery mode for forwarders

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

How to integrate threat armor with splunk?

How to integrate Google Cloud armor with splunk?

Getting Data In

Join the Conversation