Getting Data In

Community Activity

ファイル名に含まれている日付をタイムスタンプとして認識させる方法についてファイル名に日付、ログに時刻のみ出力されている場合、「ファイル名の日付＋ログ内の時刻」をタイムスタンプとして認識させることはできますか？・ファイル名 /tmp/test_2015.01.01.txt ・ログ line1 00:... by tkmq New Member in Getting Data In 07-08-2016 0 1	0	1
timestampに日本語を含む日時を指定する方法 timestamp下記のような日付を指定したいのですが、Splunkでうまく取り込めません。タイムスタンプ形式で指定すればよいのだと思うのですが、日本語の曜日を含んでいるため指定方法がわかりません。どのように指定すればよいのでしょ... by haruka_saito Explorer in Getting Data In 07-07-2016 1 1	1	1
ignoreolderthan not working? Hi, I have 2 stanza in inputs.conf: [monitor:///data3/caa/caa7/] whitelist=access.*gz ignoreOlderThan=1d disabled ... by stwong Communicator in Getting Data In 07-07-2016 0 3	0	3
How to configure Splunk to index separate events for each timestamp in my sample data? I have the following entries from a logfile created with log4j. [slf5s.start]07 Jul 2016 15:23:37,789[slf5s.DATE]WAR... by cjmckenna New Member in Getting Data In 07-07-2016 0 2	0	2
How to set Host from an extracted field? I have some BlueCoat proxy log files being indexed by Splunk. The indexer and Search Head both have the BlueCoat add-... by _smp_ Builder in Getting Data In 07-07-2016 0 8	0	8
How to change the index for a certain sourcetype? I have an index called high with sourcetype logs logs sourcetype is continuously indexing logs under \logs dir. I h... by vkakani60 Path Finder in Getting Data In 07-07-2016 0 1	0	1
How can I index SNMP traps with Splunk? I found these basic instructions in the Splunk docs - http://www.splunk.com/base/Documentation/4.0.9/Admin/SendSNMPev... by Mick Splunk Employee in Getting Data In 07-07-2016 3 4	3	4
How to install a Splunk universal forwarder via command line in low-privilege mode? I am Installing a Splunk universal forwarder using the command line with the following command in "low-privilege" mod... by email2vamsi Explorer in Getting Data In 07-07-2016 0 1	0	1
When initiating an indexer cluster, why is the restart of indexers so slow? Hi, I have two indexers linked to a master node. Since I have linked both indexers to the master node, it takes for... by ameslet Explorer in Getting Data In 07-07-2016 0 4	0	4
Same sourcetype in different TA or APPs Hello, I have a Splunk server which is Indexer and SearchHead. All of the logs are splited to different file by rs... by pvuong Explorer in Getting Data In 07-07-2016 0 4	0	4
Monitoring logs on a Windows forwarder, how do I configure line breaking so each line is a separate event? Hi, I have a forwarder on a Windows server that is pulling logs from a folder. Logs are in a single file (multiple l... by pashtet13 New Member in Getting Data In 07-07-2016 0 5	0	5
Forwarder fails, monitored file is archived, what happens? Hello, I have a hypothetical scenario which I hope someone can help me with. Let's say I have a Linux server with a... by roychen Path Finder in Getting Data In 07-07-2016 1 8	1	8
Can some data coming into Splunk via HTTP Event Collector be filtered to nullqueue based on sourcetype? When data is coming into Splunk through the HTTP Event Collector, can some of it be routed to the nullqueue based on ... by simpkins1958 Contributor in Getting Data In 07-07-2016 0 2	0	2
Can you tell me what I am doing wrong with my props.conf for this JSON file? All, I have the following little JSON dump which works perfectly out of the box. But for best practices I was writi... by daniel333 Builder in Getting Data In 07-06-2016 0 1	0	1
How to index logs of different source types in a single index? How can I index logs from different source types in the same index? Let's say Network ABC is having one AD and one Fi... by masterpiece Engager in Getting Data In 07-06-2016 0 1	0	1
How do I convert these timestamps to epoch? Need help converting these times to epoch so that I can do a DIFF between them. branchExecutionStartTime=Wed Jul 0... by kmccowen Path Finder in Getting Data In 07-06-2016 0 2	0	2
How would one investigate the sources/logic of a data model? I am reviewing data models that were created by another user. Is there an easy way to analyze them? by packet_hunter Contributor in Getting Data In 07-06-2016 0 1	0	1
How to resend the specific event log from Windows Universal Forwarder Hello Splunkers, We are collecting the Security Event Log from Windows 2012 Server which has Universal Forwarder ins... by kuga_mbsd New Member in Getting Data In 07-06-2016 0 4	0	4
Lookup- UnMatched Values http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/ConfigureCSVlookups#Prefilter_large_CSV_lookup_tables I ... by ashishlal82 Explorer in Getting Data In 07-06-2016 0 4	0	4
How to configure a Splunk 6.3.1 universal forwarder to prevent high CPU consumption? Hi, I have about 1500 Universal Forwarders installed in our environment. The UF version is 6.3.1 and installed on Wi... by omerr Explorer in Getting Data In 07-06-2016 0 3	0	3
How to reindex the same source I tried to reindex the following windows directories using "Monitor" from input data. d:\logs\appx d:\logs\appy d:\l... by vkakani60 Path Finder in Getting Data In 07-05-2016 0 5	0	5
Forward data to third-party systems Hello i am trying to forward all the indexed data to a non-splunk system. my questions is does we need to use any sp... by saifuddin9122 Path Finder in Getting Data In 07-05-2016 0 4	0	4
Array extraction with optional elements {<!-- --> "Version" : 2 Diagnostic: [ { Name: "Brian", School :"KVG" }, { Name: "Steve", School :"MKG" }, { Name: "Gerry" }... by psable Explorer in Getting Data In 07-05-2016 0 2	0	2
In an apps can I reuse lookup result to be used in another lookup? I am developing an apps, where I would like to normalize the value of a field coming from a lookup. From the documen... by ggoupil New Member in Getting Data In 07-05-2016 0 3	0	3
How to configure Splunk to recognize the timestamp format in my data where the Date and Time are not in the same line? Hello, I have a problem when I want to extract the timestamp from an event in adding data to Splunk. Here is a samp... by voshka New Member in Getting Data In 07-05-2016 0 3	0	3