Getting Data In

Community Activity

Is there a version of Splunk Universal Forwarder that is compatible with NT4? Hi folks, You'll have to excuse my memory lapse here - Splunk forwarder on NT4, installation of - I recall getting a... by sentiaglobal New Member in Getting Data In 09-30-2016 0 6	0	6
Getting too many destination ip addresses. Need to filter it down to 5 Trying to filter down to 5 search results for the dest section. index=threat_activity threat_match_field=src thre... by ecabrera81 New Member in Getting Data In 09-30-2016 0 4	0	4
Windows custom events logs not showing up in Splunk Hi , Below is custom event logs which I am configuring on windows forwarder but they are not showing up in Splunk. We... by yanivdutt Explorer in Getting Data In 09-30-2016 0 5	0	5
How Data cloning can be done through a heavy forwarder? I have a test environment(search head) in which there aren't any events. Now I want to do some data cloning and get s... by pavanae Builder in Getting Data In 09-29-2016 0 5	0	5
Timestamp Parsing in JSON Hi, Can anyone help me with best configurations for timestamp parsing (where "DateTime" is the actual time) for fol... by RichaSingh Path Finder in Getting Data In 09-29-2016 1 2	1	2
What is the best way to adjust the time value for incoming syslog events from a specific host I have a one host that has a time offset of +5 hours and would rewrite the timestamp to represent the local time zone... by ntaylorsplunk Explorer in Getting Data In 09-29-2016 0 3	0	3
Where is data input configuration information entered from Splunk Web stored? When I create a new data input (TCP port), where are these settings stored? I would have assumed it would be inputs.... by insidious New Member in Getting Data In 09-29-2016 0 2	0	2
universal forwarder trying to parse the data I have a UF monitoring a couple of files on a AIX box. The UF is forwarding the data to a HF, I verified this in outp... by reggie_123 Explorer in Getting Data In 09-29-2016 0 3	0	3
After pushing updates to inputs.conf and outputs.conf to the UF, it is not forwarding data to the indexers. How can I fix? I pushed updates to inputs.conf and outputs.conf to the universal forwarder. But it is not forwarding data to the ind... by ankithreddy777 Contributor in Getting Data In 09-29-2016 0 1	0	1
Why tcpdump says Syslog traffic from Cisco ASA is reaching the interface, but nothing shows up when searching the index? I have a Cisco ASA sending syslog data to my Splunk server. When I search for the ip address of the ASA in the Search... by rblalock New Member in Getting Data In 09-29-2016 0 6	0	6
Why was the Splunk systemd service not created? Using Centos 7.2. I just installed this on another host with same OS and it created a service in /etc/init.d This hos... by tvernick Engager in Getting Data In 09-29-2016 0 1	0	1
Consolidate similarly named log files into a single source Our Splunk environment takes input from log files dropped off by an IronPort web security appliance. The files are n... by jones4bob Explorer in Getting Data In 09-29-2016 3 5	3	5
How to forward data to a remote app from a Splunk instance that is currently both a search head and indexer? We have a well established Splunk app on an instance which is serving as a Search Head and an Indexer. However, there... by arkadyz1 Builder in Getting Data In 09-29-2016 0 4	0	4
How do i query splunk for latest and earliest time based on epoch time rather than human readable time? I have a field called as "impact_time" which has human readable dates in it. Now i want to query splunk for a range o... by tikoonikhil Explorer in Getting Data In 09-29-2016 0 1	0	1
Migrate from Heavy forwarder to Universal forwarder Hi guys, OS is Linux RH 32 bit I had HF version 5.0.5, now I installed UF 6.4.3. i386. Done migration with old_splun... by MKroki Explorer in Getting Data In 09-29-2016 0 2	0	2
Forwarding only parts of license_usage.log I'm struggling to forward only parts of Splunk's license_usage.log. Please consider the following config and tell me ... by ssauler New Member in Getting Data In 09-29-2016 0 1	0	1
What is the best way to find computer usage statistics from Active Directory and CSV data sources? Sorry for the question, I can't think of a sane & sensible way to get the data out of Splunk in a computationally eff... by alexlomas Path Finder in Getting Data In 09-29-2016 0 2	0	2
How to remove an invalid line breaker from syslog before indexing? Hi everyone, I've got an application sending data to splunk, which are split over multiple lines instead to keep eve... by vlours Explorer in Getting Data In 09-29-2016 0 3	0	3
Why is my regular expression in inputs.conf not working to monitor rotating log files? HI , I have below log files in the /repo/logs directory. http_access_management_console_2016-04-25.log http_acces... by murthychitturi New Member in Getting Data In 09-28-2016 0 3	0	3
Splunk Cloud & HTTP Event Collector: Docker log-driver error "Failed to initialize logging driver: remote error: handshake failure." I am using Splunk Cloud with the free trial period right now. I need to verify that we are able to use Splunk Cloud w... by particlebrandon Explorer in Getting Data In 09-28-2016 4 23	4	23
How to edit my regular expression to retrieve the first 7-8 characters of variable length strings that end with abcd.com? I am trying to extract router names from syslog messages. Need the regular expression to get the first 7 or 8 chara... by christopheryu Communicator in Getting Data In 09-28-2016 0 2	0	2
Indexers running out of space despite config in indexes.conf Hi all, On one of my environments, I ran out of space on the weekend. As it's not my primary production environment... by alekksi Communicator in Getting Data In 09-28-2016 0 3	0	3
Need help for monitoring files I am monitoring couple of files by specifying same source type. Inputs.conf:- [monitor://D:*\Installations\Logs*\... by hrca33 Explorer in Getting Data In 09-28-2016 0 4	0	4
How to build a form that does a drilldown to events around the selected event timestamp How to build a form that does a drilldown to events around the selected event timestamp 1 - show a list of results 2... by yannK Splunk Employee in Getting Data In 09-27-2016 0 1	0	1
Is it possible to include log contents from one sourcetype in an email alert triggered by a search on another sourcetype? I've found a few different answers that approximate, but nothing yet that I can synthesize into a new solution for my... by cacarpenter89 New Member in Getting Data In 09-27-2016 0 2	0	2

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Getting Data In

Is there a version of Splunk Universal Forwarder that is compatible with NT4?

Getting too many destination ip addresses. Need to filter it down to 5

Windows custom events logs not showing up in Splunk

How Data cloning can be done through a heavy forwarder?

Timestamp Parsing in JSON

What is the best way to adjust the time value for incoming syslog events from a specific host

Where is data input configuration information entered from Splunk Web stored?

universal forwarder trying to parse the data

After pushing updates to inputs.conf and outputs.conf to the UF, it is not forwarding data to the indexers. How can I fix?

Why tcpdump says Syslog traffic from Cisco ASA is reaching the interface, but nothing shows up when searching the index?

Why was the Splunk systemd service not created?

Consolidate similarly named log files into a single source

How to forward data to a remote app from a Splunk instance that is currently both a search head and indexer?

How do i query splunk for latest and earliest time based on epoch time rather than human readable time?

Migrate from Heavy forwarder to Universal forwarder

Forwarding only parts of license_usage.log

What is the best way to find computer usage statistics from Active Directory and CSV data sources?

How to remove an invalid line breaker from syslog before indexing?

Why is my regular expression in inputs.conf not working to monitor rotating log files?

Splunk Cloud & HTTP Event Collector: Docker log-driver error "Failed to initialize logging driver: remote error: handshake failure."

How to edit my regular expression to retrieve the first 7-8 characters of variable length strings that end with abcd.com?

Indexers running out of space despite config in indexes.conf

Need help for monitoring files

How to build a form that does a drilldown to events around the selected event timestamp

Is it possible to include log contents from one sourcetype in an email alert triggered by a search on another sourcetype?

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Event Series: Telemetry Pipeline Management

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

How to integrate threat armor with splunk?

How to integrate Google Cloud armor with splunk?

How to Integrate Iraje PAM with splunk? Is there a...

Getting Data In

Join the Conversation