Getting Data In

Community Activity

How to get the count of forwarders that are reporting from each application/Workspace? Hi Splunkers, I want to get the count of forwarders that are reporting from each application/Workspace. Example: I ... by yu94 New Member in Getting Data In 11-26-2016 0 1	0	1
what could cause “server error” or “Your network connection may have been lost or Splunk may be down" “ when trying to load MS Azure Import Identity Provider (IdP) metadata When attempting to load the idp federation meta data, encounter either “server error” or “Your network connection m... by jbarlow_splunk Splunk Employee in Getting Data In 11-26-2016 0 1	0	1
How to monitor changes made to the inputs.conf file? Hello, We update the inputs.conf file periodically. I want to keep track of changes made in the inputs.conf file. A... by AKG1_old1 Builder in Getting Data In 11-25-2016 0 5	0	5
Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder? There is a endpoint on a forwarder which lists the monitors i.e. the files indexed /servicesNS/nobody/_appname_/data/... by dominiquevocat SplunkTrust in Getting Data In 11-25-2016 0 4	0	4
I have a JSON file with two timestamps. How do I edit props.conf to extract the second timestamp? I have a JSON file with two timestamps. I would like to extract the second timestamp (highlighted in bold). I have tr... by anilchaithu Builder in Getting Data In 11-25-2016 0 1	0	1
Using indexer discovery, how to check if a forwarder has forwarded a file to the indexer cluster? Issue: - After uploading file to forwarder monitoring directory, we cannot search it on search head. Environment: -... by guotao4321 Path Finder in Getting Data In 11-24-2016 0 2	0	2
How to set the exec queue size in server.conf to increase perfmon inputs? We are trying to increase the size of exec queue since we check that for Perfmon and Wineventlog, it stores the queue... by alvn_sulendra Explorer in Getting Data In 11-24-2016 0 2	0	2
inputs.conf wildcards don't work === Splunk 5.0.2 === I'd like to monitor these files, where "manydirs" is a wildcard: /my/path/manydirs/error/*.log... by tony_luu Path Finder in Getting Data In 11-24-2016 0 3	0	3
Ingesting 3-party alerts using HTTP Event Collector problem I'm trying to ingest 3-party alerts as Notable Events in IT Service Intelligence, and I'm following the steps in the ... by thilleso Path Finder in Getting Data In 11-24-2016 0 1	0	1
Splunk TA TypeError for multiple data inputs Hey Splunk Community, I am in the process of creating a TA with Splunk Add-On Builder and I have run into a problem ... by MichaelMcAleer Path Finder in Getting Data In 11-24-2016 0 3	0	3
How to troubleshoot why our universal forwarder is not sending all events after a certain date? Good afternoon Splunk team, please could you help us with this? We have this scenario: Splunk has been logging consta... by TLAZO Explorer in Getting Data In 11-23-2016 0 8	0	8
What events are eligible for "dropClonedEventsOnQueueFull"? I am doing some event duplication to a 3rd party and I want to make sure they if their receiver goes down it doesnt e... by Lucas_K Motivator in Getting Data In 11-23-2016 0 1	0	1
Monitor Splunk Indexer OS Logs - Port Conflicts? I want to monitor /var/log on all of my Splunk Indexers. However, when I configured this, I was then getting issues ... by aferone Builder in Getting Data In 11-23-2016 0 2	0	2
How to remove characters in my json raw data so it can be indexed in son formate? {"ts":"11 03 2016 06:03:56.390","th":"sample-product","user":"apple","device":"iphone","errorCode":"","level":"INFO",... by appache Path Finder in Getting Data In 11-23-2016 0 4	0	4
Why are audittrail and splunkd sourcetypes eating up 1/5th of my allowed indexing? So I was confused as to why the small amount I was indexing from my event logs every day was getting me so close to m... by juriggs Path Finder in Getting Data In 11-23-2016 0 8	0	8
When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"? HI, Since yesterday, when I add data into Splunk and choose "Preview data before indexing" this error message appea... by criferr New Member in Getting Data In 11-23-2016 0 2	0	2
How to only index events that contain specific fields? Hello, all. I know that my question's not a unique, but I want to ask it  I have a netflow text log on a server wit... by templier Communicator in Getting Data In 11-23-2016 1 13	1	13
TCP:9514 logs doesn't show in Splunk Hi Team, I have configured a Cisco router to send syslogs to Splunk over TCP port 9514. But that doesn't show up in ... by krishnaar New Member in Getting Data In 11-23-2016 0 7	0	7
File integrity error Hello, I get this error in the splunk server "File Integrity checks found 1 files that did not match the system-prov... by RihabCH2 Engager in Getting Data In 11-23-2016 0 1	0	1
How to pick your local domain controller for event log SID translation? Hi, We recently deployed the following config to 500 Windows Universal Forwarders: [WinEventLog://Security] disabl... by javiergn Super Champion in Getting Data In 11-23-2016 2 2	2	2
How to troubleshoot why my scripted input on Solaris is not working? All, Not really a SunOS guy, so might be missing something fundamental. I wrote the script I need, and it runs fine... by daniel333 Builder in Getting Data In 11-22-2016 0 3	0	3
How to add parallelIngestionPipelines to server.conf in an indexer cluster? Hi All, We have an indexer cluster and cluster master. we need to add the parameter below in the indexer cluster ser... by rsathish47 Contributor in Getting Data In 11-22-2016 0 1	0	1
How to remove inner double quotes from json data?? Hello i am trying to remove inner double quotes from json data here is my sample data: {"msg": "the message "is p... by AzmathShaik Path Finder in Getting Data In 11-22-2016 0 2	0	2
Whats the best way to blacklist a Windows event code? I have over 300 Universal forwarders and I'm getting several eventcode=5156 events errors. Is there a way to blackli... by mrtolu6 Path Finder in Getting Data In 11-22-2016 0 4	0	4
Splunk offline command and bucket replication Reading through the "offline" documentation & "maintenance" mode documentation, I'm slighly confused, if we need to d... by koshyk Super Champion in Getting Data In 11-22-2016 0 2	0	2

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...

Getting Data In

How to get the count of forwarders that are reporting from each application/Workspace?

what could cause “server error” or “Your network connection may have been lost or Splunk may be down" “ when trying to load MS Azure Import Identity Provider (IdP) metadata

How to monitor changes made to the inputs.conf file?

Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder?

I have a JSON file with two timestamps. How do I edit props.conf to extract the second timestamp?

Using indexer discovery, how to check if a forwarder has forwarded a file to the indexer cluster?

How to set the exec queue size in server.conf to increase perfmon inputs?

inputs.conf wildcards don't work

Ingesting 3-party alerts using HTTP Event Collector problem

Splunk TA TypeError for multiple data inputs

How to troubleshoot why our universal forwarder is not sending all events after a certain date?

What events are eligible for "dropClonedEventsOnQueueFull"?

Monitor Splunk Indexer OS Logs - Port Conflicts?

How to remove characters in my json raw data so it can be indexed in son formate?

Why are audittrail and splunkd sourcetypes eating up 1/5th of my allowed indexing?

When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"?

How to only index events that contain specific fields?

TCP:9514 logs doesn't show in Splunk

File integrity error

How to pick your local domain controller for event log SID translation?

How to troubleshoot why my scripted input on Solaris is not working?

How to add parallelIngestionPipelines to server.conf in an indexer cluster?

How to remove inner double quotes from json data??

Whats the best way to blacklist a Windows event code?

Splunk offline command and bucket replication

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Issue facing while installing Splunk Add-on for AW...

Google workspace Meet logs

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

Getting Data In

Join the Conversation