Getting Data In

Community Activity

cut a specific phrase in props.conf Hi Community,how to cut..., "q": 0, "user": "system.user.admin"...from...{ "val": 0, "ts": 1770058561014, "q": 0, "us... by GSNRMUVW Loves-to-Learn in Getting Data In 02-02-2026 0 6	0	6
Amazon Linux 2023 performance troubleshooting I have been tasked with building out new instances of anything that runs an older OS, and for our EC2 instances this ... by briancronrath Contributor in Getting Data In 02-02-2026 0 1	0	1
How to Integrate and ingest the audit logs of Cymulate (Breach Attack Simulation) into Splunk We have employed Cymulate, a BAS (Breach Attack Simulation) Solution for Red Teaming activity and Detection Engineeri... by Jayanthan Loves-to-Learn Everything in Getting Data In 01-30-2026 0 0	0	0
What's wrong with this REGEX? I have this "innocent" regex to send to the nullQueue in transforms.conf, and it doesn't work. I'm scratching my head... by danielbb Motivator in Getting Data In 01-29-2026 0 5	0	5
Indexer Sizing We would like your guidance on how to calculate the required number of Splunk indexers for our environment.Currently,... by msaleh7422 Engager in Getting Data In 01-28-2026 0 2	0	2
Duplicates XML events in file monitoring Hello Splunker, i need your help.I have a problem with monitoring a single XML file that records events from an appli... by LM_ACN Engager in Getting Data In 01-27-2026 0 2	0	2
Splunk listen on port 514 UDP Hi,I understand that ports below 1024 are reserved for root access. Is there any supported way for Splunk to listen o... by ws Path Finder in Getting Data In 01-26-2026 0 6	0	6
How to Identify which HF is sending logs/metrics Hi,I have incoming data from 2 Heavy Forwarders.Both of forward HEC data and the internal logs, how do I identify whi... by _pravin Contributor in Getting Data In 01-22-2026 0 14	0	14
What's the best way to handle multiple different time formats in the same source? Hello Splunk Community,My team is currently processing logs from a single source that can contain events with differe... by spl_aficionado Path Finder in Getting Data In 01-21-2026 0 6	0	6
Splunk and TheHive integration Hey!My team is interested in integration of Splunk (especially ES) and TheHive Project products.The goal is to provid... by bil151515 Engager in Getting Data In 01-20-2026 1 3	1	3
Struggling with setting up SC4S in an air-gapped environment – looking for the best deployment approach Hi,I’m trying to use Splunk as a log aggregation solution, and eventually as a SIEM. I have three industrial plants ... by kn450 Explorer in Getting Data In 01-19-2026 0 1	0	1
HF licensing when License Manager is not reachable due to network restrictions We have a distributed on-prem Splunk environment with strict network segmentation between sites.Scenario:Site B:Sourc... by ibrahim1 Explorer in Getting Data In 01-19-2026 0 11	0	11
Timestamp configuration in props for epoch time Dear All,I am getting data from the Search head in json format. The first field of the event is timestamp and it is i... by Tamilraj28 Engager in Getting Data In 01-18-2026 0 1	0	1
How to use Lambda to push logs to Splunk Cloud I'm trying to onboard data from AWS to Splunk Cloud and planning to use Lambda But we have numerous options within La... by richah Explorer in Getting Data In 01-18-2026 0 1	0	1
Field Extractions in Splunk GovCloud I'm in the process of setting up a new Splunk GovCloud instance, and I'm having no luck getting field extractions to ... by bpenny Explorer in Getting Data In 01-16-2026 0 5	0	5
Why do we have major indexing delays for some sourcetypes of Google Workspace? Looking at our Google Workspace data flow, and we experience consistent 4 to 5 hour indexing delays with most of the ... by danielbb Motivator in Getting Data In 01-16-2026 0 3	0	3
Dashboard Hey all, I am running into an issue on one of my dashboards. The issue in questions states "could not load lookup= LO... by 808antwon Loves-to-Learn in Getting Data In 01-15-2026 0 1	0	1
Integration of MS Exchange server with splunk Dear All, I need your assistance in fetching Microsoft Exchange Server logs using the Splunk Universal Forwarder. I c... by I_B New Member in Getting Data In 01-15-2026 0 3	0	3
Splunk Enteprise Delayed searches Hello Team,I wanna ask something that I really cannot figure out by myself , I have a splunk entreprise Installed on ... by fedayn05 Path Finder in Getting Data In 01-13-2026 0 8	0	8
[HEC] Endpoint : TCP reset session all time Hello Everyone, I need your help about a problem with Splunk HEC. I use the endpoint "event" to send logs into multip... by shinigami35 Explorer in Getting Data In 01-13-2026 0 16	0	16
Splunk does not detect new files on CIFS-mounted directory until restart EnvironmentSplunk Enterprise (single-instance: indexing + monitoring on same host)OS: LinuxLog directory mounted via ... by koyachi Explorer in Getting Data In 01-13-2026 0 1	0	1
How can I stream Google Workspace Vault logs into Splunk? I want to add vault logs to my inputs.conf for the Google Workspace TA. I added the following stanza[activity_report:... by danielbb Motivator in Getting Data In 01-12-2026 0 3	0	3
Splunk Add-On for Windows - Incorrect TaskCategory I am running into an issue where the TaskCategory field extracted by the Splunk Add-On for Windows does not match the... by nixhydra Explorer in Getting Data In 01-12-2026 0 11	0	11
Best architecture for collecting logs from a third-party app hosted on AWS via API calls (Splunk Enterprise On-Prem) Hello Splunk community,I’m working with Splunk Enterprise On-Prem and have three Heavy Forwarders (HFs) in my enviro... by Nicolas2203 Path Finder in Getting Data In 01-09-2026 0 2	0	2
Why Splunk HF sends all its inthernal logs to Syslog reciever Hello Team , I want to send splunk HF windows security logs to a syslog server . I have syslog-ng installed there whi... by vikasg Loves-to-Learn Lots in Getting Data In 01-08-2026 0 4	0	4