Getting Data In

Community Activity

TCP data input: Why is splunk receiving only some data? Is there a limit that needs to be configured? Hello team, When sent data from my cloudbees syslog java client using tcp data input, only some data is making it to... by jimrantoday Explorer in Getting Data In 01-26-2017 2 8	2	8
After configuring props and transforms to extract the host from events, why are no results returned searching the host field? Hi Forum, i'm dealing with collectd data. This data generates events looking like this: hostname.cpu-0.cpu-wait 0 ... by schose Builder in Getting Data In 01-26-2017 1 5	1	5
Can we configure the forwarders to use SFTP for transferring the files? Can we configure the forwarders to use SFTP for transferring the files? If not is there any way to encrypt data by Un... by ankithreddy777 Contributor in Getting Data In 01-26-2017 1 1	1	1
date_zone field has value 'local' & '0' HI, Splunk Version : Splunk 6.1.1 Splunk Universal forwarder : version 5.0.4 I see the field 'date_zone' has values... by splunker12er Motivator in Getting Data In 01-26-2017 1 3	1	3
Why does my tstats search only show results for the main index? \|tstats values(sourcetype) by index I have 10 indexes, but I only get "main" when I run the search above. How can ... by packet_hunter Contributor in Getting Data In 01-26-2017 0 1	0	1
Is there a way to set a tag by source in inputs.conf? I'm writing an app where it has multiple sources that will be assigned to the sourcetype log4j. Searching for these l... by splunkto Explorer in Getting Data In 01-26-2017 0 2	0	2
How to bulk delete multiple hosts from Splunk that have not phoned home within a set interval? Good morning. I am brand new to Splunk and so far so good  We operate in the MS Azure Cloud and many of our systems... by brent_weaver Builder in Getting Data In 01-26-2017 1 10	1	10
How to pull Sharepoint document library meta data into Splunk? I want to create a Splunk app that uses document meta data from a document library to create reports based on their m... by tesorrells New Member in Getting Data In 01-26-2017 0 5	0	5
Why has Splunk stopped indexing my files? Customer reported that a standalone Splunk Indexer had stopped indexing any monitored files. They also noticed that :... by dshakespeare_sp Splunk Employee in Getting Data In 01-26-2017 1 2	1	2
Why am I unable to delete indexes from the Splunk Web? Why do I have to restart Splunk when I create a new Index from Splunk Web? Customer reported several issue with Index Management using the Splunk Web: - Unable to create new Indexes from Setti... by dshakespeare_sp Splunk Employee in Getting Data In 01-26-2017 1 1	1	1
Why is an indexer in a cluster reporting "CMMessages - got genid thats invalid or out of range, setting to INVALID_GENID"? Hello, I have an indexer node running Splunk Version 6.3.2 (build aaff59bb082c) that constantly outputs the followin... by gpaks Engager in Getting Data In 01-26-2017 2 3	2	3
How do i convert/fix my cooked data to human readable data? I've installed a universal forwarder(A) on a linux box which monitors a .log file and forwards data to an intermediat... by rewritex Contributor in Getting Data In 01-25-2017 0 5	0	5
How do I remove host from Data Summary screen but keep data? Hello, I'm looking for advice on how to handle systems that are removed from the network. We have several hundred... by gph12 Explorer in Getting Data In 01-25-2017 0 2	0	2
LINE_BREAKER not working correctly The event I want to break on looks like this: 25/Jan/17:10:23:00:069+0000 DEBUG Evaluation of condition [188:FTP Ma... by pkeller Contributor in Getting Data In 01-25-2017 0 2	0	2
What is the best way to collect all DNS queries by client and Responses sent back by a Windows 2012 DNS Server with a universal forwarder? We have Universal Forwarder installed on MS Windows 2012 DNS server. what is best way to collect all the DNS queries ... by shafqat571 Explorer in Getting Data In 01-25-2017 1 3	1	3
How can I filter data in search-time from a generated csv file? Hi, I have a csv file, generated each day from a Powershell script under the Splunk app lookups directory. I use th... by skender27 Contributor in Getting Data In 01-25-2017 0 2	0	2
For Wineventlog, Event ID captures User info, but why does Splunk raw data show user User=NOT_TRANSLATED? Issue is that for the Wineventlog for Application channel EventCode=11707 and EventCode=11724, intermittently _raw da... by rbal_splunk Splunk Employee in Getting Data In 01-25-2017 0 1	0	1
How to collect Windows event logs that are not from .evtx or .evt files? I'm trying to collect Windows events. Specifically, I'm trying to collect: \\Applications and Service Logs\Microsof... by stcrispan Communicator in Getting Data In 01-25-2017 3 9	3	9
Is there a feature in Splunk (similar to Dropbox) where can i drop multiple log files from multiple locations? Is there a feature in Splunk (like Dropbox) to drop all types of logs from different applications ? Where can i drop... by sai_john New Member in Getting Data In 01-25-2017 0 11	0	11
Permission denied I am running Splunk enterprise 6.3.1 and universal forwarder. We deploy the universal forwarder onto a Linux machine... by tattersp Explorer in Getting Data In 01-25-2017 0 4	0	4
Ingested a year's worth of events in Windows from one source, but why did Splunk not index all logs? I was indexing a years worth of logs (200+GB) from one source path. Data was indexed, but I am trying to understand ... by CaptainHook Communicator in Getting Data In 01-25-2017 0 4	0	4
How to add Data Sources from different devices to Splunk? How to Add Data Sources from the following devices: No\| Data Type \| No’s of devices \| Lo... by fazilhussain Explorer in Getting Data In 01-25-2017 1 3	1	3
How to configure Splunk to not index a line before it is finished writing? We are writing out to a log for which splunk is indexing for most lines okay, but some times splunk indexes before th... by BrendanMcE Path Finder in Getting Data In 01-24-2017 1 5	1	5
Is it possible to define a custom location for universal forwarder local configurations? My Splunk Forwarder is installed on a share, which can be mapped to all the servers in my environment. Therefore, I ... by marlog Explorer in Getting Data In 01-24-2017 0 1	0	1
Why am I unable to install a Splunk Forwarder on Windows 2008 64 bit (non domain controller) with error "Faulting application openssl.exe.."? My attempts to install a Splunk forwarder on Windows 2008 fails and is rolled back. In this case, the application ev... by wilsonchua New Member in Getting Data In 01-24-2017 0 1	0	1

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Getting Data In

TCP data input: Why is splunk receiving only some data? Is there a limit that needs to be configured?

After configuring props and transforms to extract the host from events, why are no results returned searching the host field?

Can we configure the forwarders to use SFTP for transferring the files?

date_zone field has value 'local' & '0'

Why does my tstats search only show results for the main index?

Is there a way to set a tag by source in inputs.conf?

How to bulk delete multiple hosts from Splunk that have not phoned home within a set interval?

How to pull Sharepoint document library meta data into Splunk?

Why has Splunk stopped indexing my files?

Why am I unable to delete indexes from the Splunk Web? Why do I have to restart Splunk when I create a new Index from Splunk Web?

Why is an indexer in a cluster reporting "CMMessages - got genid thats invalid or out of range, setting to INVALID_GENID"?

How do i convert/fix my cooked data to human readable data?

How do I remove host from Data Summary screen but keep data?

LINE_BREAKER not working correctly

What is the best way to collect all DNS queries by client and Responses sent back by a Windows 2012 DNS Server with a universal forwarder?

How can I filter data in search-time from a generated csv file?

For Wineventlog, Event ID captures User info, but why does Splunk raw data show user User=NOT_TRANSLATED?

How to collect Windows event logs that are not from .evtx or .evt files?

Is there a feature in Splunk (similar to Dropbox) where can i drop multiple log files from multiple locations?

Permission denied

Ingested a year's worth of events in Windows from one source, but why did Splunk not index all logs?

How to add Data Sources from different devices to Splunk?

How to configure Splunk to not index a line before it is finished writing?

Is it possible to define a custom location for universal forwarder local configurations?

Why am I unable to install a Splunk Forwarder on Windows 2008 64 bit (non domain controller) with error "Faulting application openssl.exe.."?

Data Management Digest – August 2026

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Issue facing while installing Splunk Add-on for AW...

Google workspace Meet logs

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

Getting Data In

Join the Conversation