Getting Data In

Community Activity

REST API to push data into Splunk We are trying to push the application real time data into Splunk as part of code base, Do we have any REST API to pus... by dhavamanis Builder in Getting Data In 10-03-2016 0 2	0	2
how can i configure my search head to get the data from a heavy forwarder? I am aware of getting the data from an universal forwarder?. Can anyone explain me the process of getting data from a... by pavanae Builder in Getting Data In 10-03-2016 1 2	1	2
Monitor windows file using environment variable in the path Hi All, Can we specify environment variables of windows in the monitor stanza. For example like below: [monitor://%... by bharathkumarnec Contributor in Getting Data In 10-03-2016 1 2	1	2
How to store or index data from multiple clients that have multiple servers? Hello. First time I'm posting a question, and a relative new to Splunk so I apologize up front if this has already ... by makincerdas Explorer in Getting Data In 10-03-2016 0 9	0	9
Is there any risk in load balancing universal forwarder to an intermediate forwarder using a dedicated load balancer? Hello! Our setup consists of Universal Forwarders sending logs through a load balancer to Intermediate Forwarders th... by AlexCUbisoft New Member in Getting Data In 10-03-2016 0 2	0	2
Splunk Reading a File we didn't tell it to per LSOF All, I am trying to understand why Splunk it opening a file here. When I run LSOF I see Splunk looking at a rolle... by daniel333 Builder in Getting Data In 10-01-2016 0 1	0	1
Does a multiple IPs hostname trigger Forwarder round robin? When writing outputs.conf, setting several receivers to "server=" causes the forwarder to round robin through those r... by uchoa Engager in Getting Data In 10-01-2016 0 1	0	1
unable to read field names with space using mulikv From log file , i have mixed data some wher i have student data as below bla bla... bla blaa.. list of the student a... by kanalasreekanth New Member in Getting Data In 10-01-2016 0 1	0	1
How can I route data to specific indexers using a heavy forwarder? I have a universal forwarder that sends 2 source types to heavy forwarder successfully. i need this heavy forwarder t... by MAShawky Explorer in Getting Data In 09-30-2016 2 2	2	2
Failed Logons To Splunk Is there a way to search by failed logons to Splunk? I'd like to create an alert if a user attempts to logon but is ... by peasead Path Finder in Getting Data In 09-30-2016 0 3	0	3
Filter Client IP from IIS 7.5 Logs Hello, all. I would like to filter out a specific client IP address from my IIS logs. What would be the best appro... by rmsit Communicator in Getting Data In 09-30-2016 0 5	0	5
Is there a version of Splunk Universal Forwarder that is compatible with NT4? Hi folks, You'll have to excuse my memory lapse here - Splunk forwarder on NT4, installation of - I recall getting a... by sentiaglobal New Member in Getting Data In 09-30-2016 0 6	0	6
Getting too many destination ip addresses. Need to filter it down to 5 Trying to filter down to 5 search results for the dest section. index=threat_activity threat_match_field=src thre... by ecabrera81 New Member in Getting Data In 09-30-2016 0 4	0	4
Windows custom events logs not showing up in Splunk Hi , Below is custom event logs which I am configuring on windows forwarder but they are not showing up in Splunk. We... by yanivdutt Explorer in Getting Data In 09-30-2016 0 5	0	5
How Data cloning can be done through a heavy forwarder? I have a test environment(search head) in which there aren't any events. Now I want to do some data cloning and get s... by pavanae Builder in Getting Data In 09-29-2016 0 5	0	5
Timestamp Parsing in JSON Hi, Can anyone help me with best configurations for timestamp parsing (where "DateTime" is the actual time) for fol... by RichaSingh Path Finder in Getting Data In 09-29-2016 1 2	1	2
What is the best way to adjust the time value for incoming syslog events from a specific host I have a one host that has a time offset of +5 hours and would rewrite the timestamp to represent the local time zone... by ntaylorsplunk Explorer in Getting Data In 09-29-2016 0 3	0	3
Where is data input configuration information entered from Splunk Web stored? When I create a new data input (TCP port), where are these settings stored? I would have assumed it would be inputs.... by insidious New Member in Getting Data In 09-29-2016 0 2	0	2
universal forwarder trying to parse the data I have a UF monitoring a couple of files on a AIX box. The UF is forwarding the data to a HF, I verified this in outp... by reggie_123 Explorer in Getting Data In 09-29-2016 0 3	0	3
After pushing updates to inputs.conf and outputs.conf to the UF, it is not forwarding data to the indexers. How can I fix? I pushed updates to inputs.conf and outputs.conf to the universal forwarder. But it is not forwarding data to the ind... by ankithreddy777 Contributor in Getting Data In 09-29-2016 0 1	0	1
Why tcpdump says Syslog traffic from Cisco ASA is reaching the interface, but nothing shows up when searching the index? I have a Cisco ASA sending syslog data to my Splunk server. When I search for the ip address of the ASA in the Search... by rblalock New Member in Getting Data In 09-29-2016 0 6	0	6
Why was the Splunk systemd service not created? Using Centos 7.2. I just installed this on another host with same OS and it created a service in /etc/init.d This hos... by tvernick Engager in Getting Data In 09-29-2016 0 1	0	1
Consolidate similarly named log files into a single source Our Splunk environment takes input from log files dropped off by an IronPort web security appliance. The files are n... by jones4bob Explorer in Getting Data In 09-29-2016 3 5	3	5
How to forward data to a remote app from a Splunk instance that is currently both a search head and indexer? We have a well established Splunk app on an instance which is serving as a Search Head and an Indexer. However, there... by arkadyz1 Builder in Getting Data In 09-29-2016 0 4	0	4
How do i query splunk for latest and earliest time based on epoch time rather than human readable time? I have a field called as "impact_time" which has human readable dates in it. Now i want to query splunk for a range o... by tikoonikhil Explorer in Getting Data In 09-29-2016 0 1	0	1

Get Updates on the Splunk Community!

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26 With threats moving at machine speed and attack surfaces expanding across hybrid ...

Getting Data In

REST API to push data into Splunk

how can i configure my search head to get the data from a heavy forwarder?

Monitor windows file using environment variable in the path

How to store or index data from multiple clients that have multiple servers?

Is there any risk in load balancing universal forwarder to an intermediate forwarder using a dedicated load balancer?

Splunk Reading a File we didn't tell it to per LSOF

Does a multiple IPs hostname trigger Forwarder round robin?

unable to read field names with space using mulikv

How can I route data to specific indexers using a heavy forwarder?

Failed Logons To Splunk

Filter Client IP from IIS 7.5 Logs

Is there a version of Splunk Universal Forwarder that is compatible with NT4?

Getting too many destination ip addresses. Need to filter it down to 5

Windows custom events logs not showing up in Splunk

How Data cloning can be done through a heavy forwarder?

Timestamp Parsing in JSON

What is the best way to adjust the time value for incoming syslog events from a specific host

Where is data input configuration information entered from Splunk Web stored?

universal forwarder trying to parse the data

After pushing updates to inputs.conf and outputs.conf to the UF, it is not forwarding data to the indexers. How can I fix?

Why tcpdump says Syslog traffic from Cisco ASA is reaching the interface, but nothing shows up when searching the index?

Why was the Splunk systemd service not created?

Consolidate similarly named log files into a single source

How to forward data to a remote app from a Splunk instance that is currently both a search head and indexer?

How do i query splunk for latest and earliest time based on epoch time rather than human readable time?

Event Series: The Agentic SOC: Trust Before Autonomy

Free Professional Services for .conf26 Attendees

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Issue facing while installing Splunk Add-on for AW...

Google workspace Meet logs

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

Getting Data In

Join the Conversation