Getting Data In

Community Activity

Why is my current file monitor configuration always missing the first line of a CSV file that has no headers? I've got a file monitor set up for a headerless CSV file which I generate on a periodic basis. I've noticed that the ... by JeremyHagan Communicator in Getting Data In 11-28-2016 0 3	0	3
Invalid earliest_time error using the java SDK I'm trying to search using a time range and the query works fine from the UI but when I use curl from the command lin... by sharninder New Member in Getting Data In 11-28-2016 0 3	0	3
Does Splunk support Parquet data format? Does Splunk (not Hunk) support parquet? Trying to determine if Splunk can support reading parquet format. by prats84 Explorer in Getting Data In 11-28-2016 0 1	0	1
How to resolve "ssl23_get_client_hello unknown protocol" error on indexer and "TcpOutputFd Read error" on forwarder? Hello guys, I'm using this on deployment-apps (universal forwarder deployment) : [tcpout] defaultGroup = default-au... by splunkreal Influencer in Getting Data In 11-28-2016 0 2	0	2
How do I send data from Kiwi syslog to a Splunk indexer on the same server? I am new to Splunk. I have installed Splunk ES 6.2.3 as an Indexer on a Windows 2008 R2 server. As an initial test,... by tladd1212 New Member in Getting Data In 11-27-2016 0 7	0	7
I have logs with out-of-order timestamped events. Will searches compensate for this and correct the timestamp order? Given this excerpt from log files I generate and index: 2016-11-19 20:34:21 GMT vehicle_id="1009" route="E" speed=0 ... by plucas_splunk Splunk Employee in Getting Data In 11-27-2016 0 3	0	3
Is the Splunk Trial license limited in collecting remote data? Hello, i have installed the trial Splunk Enterprise in Linux. I have installed also the Universal Forwarder in Window... by jchr87 New Member in Getting Data In 11-26-2016 0 7	0	7
Line break involving CRLF Hi, I have JSON msgs in my log which has Carriage Return Line Feed character at the end of each line and the next l... by nithin204 Explorer in Getting Data In 11-26-2016 0 4	0	4
How to get the count of forwarders that are reporting from each application/Workspace? Hi Splunkers, I want to get the count of forwarders that are reporting from each application/Workspace. Example: I ... by yu94 New Member in Getting Data In 11-26-2016 0 1	0	1
what could cause “server error” or “Your network connection may have been lost or Splunk may be down" “ when trying to load MS Azure Import Identity Provider (IdP) metadata When attempting to load the idp federation meta data, encounter either “server error” or “Your network connection m... by jbarlow_splunk Splunk Employee in Getting Data In 11-26-2016 0 1	0	1
How to monitor changes made to the inputs.conf file? Hello, We update the inputs.conf file periodically. I want to keep track of changes made in the inputs.conf file. A... by AKG1_old1 Builder in Getting Data In 11-25-2016 0 5	0	5
Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder? There is a endpoint on a forwarder which lists the monitors i.e. the files indexed /servicesNS/nobody/_appname_/data/... by dominiquevocat SplunkTrust in Getting Data In 11-25-2016 0 4	0	4
I have a JSON file with two timestamps. How do I edit props.conf to extract the second timestamp? I have a JSON file with two timestamps. I would like to extract the second timestamp (highlighted in bold). I have tr... by anilchaithu Builder in Getting Data In 11-25-2016 0 1	0	1
Using indexer discovery, how to check if a forwarder has forwarded a file to the indexer cluster? Issue: - After uploading file to forwarder monitoring directory, we cannot search it on search head. Environment: -... by guotao4321 Path Finder in Getting Data In 11-24-2016 0 2	0	2
How to set the exec queue size in server.conf to increase perfmon inputs? We are trying to increase the size of exec queue since we check that for Perfmon and Wineventlog, it stores the queue... by alvn_sulendra Explorer in Getting Data In 11-24-2016 0 2	0	2
inputs.conf wildcards don't work === Splunk 5.0.2 === I'd like to monitor these files, where "manydirs" is a wildcard: /my/path/manydirs/error/*.log... by tony_luu Path Finder in Getting Data In 11-24-2016 0 3	0	3
Ingesting 3-party alerts using HTTP Event Collector problem I'm trying to ingest 3-party alerts as Notable Events in IT Service Intelligence, and I'm following the steps in the ... by thilleso Path Finder in Getting Data In 11-24-2016 0 1	0	1
Splunk TA TypeError for multiple data inputs Hey Splunk Community, I am in the process of creating a TA with Splunk Add-On Builder and I have run into a problem ... by MichaelMcAleer Path Finder in Getting Data In 11-24-2016 0 3	0	3
How to troubleshoot why our universal forwarder is not sending all events after a certain date? Good afternoon Splunk team, please could you help us with this? We have this scenario: Splunk has been logging consta... by TLAZO Explorer in Getting Data In 11-23-2016 0 8	0	8
What events are eligible for "dropClonedEventsOnQueueFull"? I am doing some event duplication to a 3rd party and I want to make sure they if their receiver goes down it doesnt e... by Lucas_K Motivator in Getting Data In 11-23-2016 0 1	0	1
Monitor Splunk Indexer OS Logs - Port Conflicts? I want to monitor /var/log on all of my Splunk Indexers. However, when I configured this, I was then getting issues ... by aferone Builder in Getting Data In 11-23-2016 0 2	0	2
How to remove characters in my json raw data so it can be indexed in son formate? {"ts":"11 03 2016 06:03:56.390","th":"sample-product","user":"apple","device":"iphone","errorCode":"","level":"INFO",... by appache Path Finder in Getting Data In 11-23-2016 0 4	0	4
Why are audittrail and splunkd sourcetypes eating up 1/5th of my allowed indexing? So I was confused as to why the small amount I was indexing from my event logs every day was getting me so close to m... by juriggs Path Finder in Getting Data In 11-23-2016 0 8	0	8
When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"? HI, Since yesterday, when I add data into Splunk and choose "Preview data before indexing" this error message appea... by criferr New Member in Getting Data In 11-23-2016 0 2	0	2
How to only index events that contain specific fields? Hello, all. I know that my question's not a unique, but I want to ask it  I have a netflow text log on a server wit... by templier Communicator in Getting Data In 11-23-2016 1 13	1	13

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Getting Data In

Why is my current file monitor configuration always missing the first line of a CSV file that has no headers?

Invalid earliest_time error using the java SDK

Does Splunk support Parquet data format?

How to resolve "ssl23_get_client_hello unknown protocol" error on indexer and "TcpOutputFd Read error" on forwarder?

How do I send data from Kiwi syslog to a Splunk indexer on the same server?

I have logs with out-of-order timestamped events. Will searches compensate for this and correct the timestamp order?

Is the Splunk Trial license limited in collecting remote data?

Line break involving CRLF

How to get the count of forwarders that are reporting from each application/Workspace?

what could cause “server error” or “Your network connection may have been lost or Splunk may be down" “ when trying to load MS Azure Import Identity Provider (IdP) metadata

How to monitor changes made to the inputs.conf file?

Forwarder REST API: How can I get the list of files monitored by a deployment app on a forwarder?

I have a JSON file with two timestamps. How do I edit props.conf to extract the second timestamp?

Using indexer discovery, how to check if a forwarder has forwarded a file to the indexer cluster?

How to set the exec queue size in server.conf to increase perfmon inputs?

inputs.conf wildcards don't work

Ingesting 3-party alerts using HTTP Event Collector problem

Splunk TA TypeError for multiple data inputs

How to troubleshoot why our universal forwarder is not sending all events after a certain date?

What events are eligible for "dropClonedEventsOnQueueFull"?

Monitor Splunk Indexer OS Logs - Port Conflicts?

How to remove characters in my json raw data so it can be indexed in son formate?

Why are audittrail and splunkd sourcetypes eating up 1/5th of my allowed indexing?

When I add data in Splunk, why does "Preview data before indexing" result in error "The read operation timed out"?

How to only index events that contain specific fields?

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

Issue facing while installing Splunk Add-on for AW...

Google workspace Meet logs

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

Getting Data In

Join the Conversation