Getting Data In

Discussions

Thread Info

XML tag extraction

I have a datasource that reads in events in XML format. Could someone please help me build a props.conf that will ext...

by Path Finder in

Are events from a particular source not getting indexed every night from 8pm to 12am, but events show up 24 hour later?

Events from a particular source do not get indexed every night from 8pm to 12am. However 24 hours later the events sh...

by Explorer in

How to collect Microsoft Web Application Proxy logs from a remote host?

Hi, I want to collect Microsoft Web Application Proxy logs from a remote host. I tried with WMI, but in the Splun...

by New Member in

Is the search I'm giving my transaction too broad? I get results with an additional filter on the initial search, but no results if I remove the filter.

I'm trying to identify all log messages that are part of our application's start up on a host,source pair. I've ident...

by Engager in

How do I set up Splunk Enterprise Linux to ingest Windows logs that are not part of the universal forwarder install?

I am new to Splunk. The main admin left a few months ago and I have taken over with little to no training. A colleagu...

by Path Finder in

How to configure inputs.conf to monitor evtx files from a UNC path?

Hi all, I have a search head running on Windows operation system and I want to monitor evt & evtx (Windows Events-...

by Explorer in

Why am I getting "memPartAlloc: block too big" sending my SIP phone syslog to universal forwarders?

Hi all, This morning, after some verification, I found some errors in my search headwith my SIP phones. I have 150...

by Path Finder in

How to monitor a folder for newest files only? (files with a change date of 2015, and then only monitor changes after that)

I want to monitor a folder that has 24 thousand files. I only want to collect data from the files that have a change ...

by Motivator in

Which server/port/config used for log receive on splunk light like *.cloud.splunk.com?

In menu Data, no menu Receiving. (There was an error retrieving the configuration, can not process this page.)In menu...

by Explorer in

If passing a parameter from main dashboard to next view, how to show this parameter as read only in the label or input type field?

I am passing a parameter from main dashboard to next view. I want to show that parameter to the user in the label or ...

by Explorer in

How to setup "Metadata" characteristics in Splunk DB connect V2, for the query results received from Microsoft SQL Server 2012?

Hello, Finally I have configure my Remote sql server database with splunk using Splunk DB connect V2, but.. in my ...

by Path Finder in

An update was made to the identities.csv and now I'm not seeing the expected result count. What is going on?

If I run: | inputlookup identities.csv xxxx results That shows a different count in the results than | ...

by Splunk Employee in

If I have 70+ devices writing data to UDP port 514, how do I route 5 IP addresses to one index, and the rest to another index?

Hi, I have a very specific problem. I have more than 70 devices writing data to UDP port 514. Now I need to input ...

by Path Finder in

Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

My team has been thinking about changing to the Splunk CLI oneshot command instead of the Splunk Universal Forwarder ...

by Contributor in

Splunk overwrites outputs.conf and inputs.conf on reboot

Greetings! I'm trying to set up a splunk forwarder to use ssl between it and the indexer. I am only interested in ...

by Explorer in

When will search head clustering be available for windows? (Officially Supported)

Looking for an ETA for when windows gets Search head clustering. Splunk does not currently support search head cl...

by Communicator in

Splunk is adding weird strings like "_linebreaker\x00\x00" to my events, what is going on?

Before forwarding data I checked to see if it was indexing properly and it seemed to have no problems. However, once ...

by Splunk Employee in

Why does configuring props.conf with DATETIME_CONFIG = NONE cause less events to be indexed from Tomcat logs?

I discovered this quite by accident while testing with a sample of Tomcat logs. If I index them without customizi...

by Motivator in

Getting Error while doing MS Sql connection : Encountered the following error while trying to save: In handler 'databases': Error connecting to database: java.sql.SQLException: Network error IOException: Connection refused: connect

I'm currently getting this error while doing trying to create an MS SQL connection: Encountered the following err...

by Path Finder in

Can I add an Index-Cluster to a Multisite-Index-Cluster

Hello all, I currently have a quite big splunk infrastructure with a multisite cluster (5 sites) each site has tw...

by Path Finder in

How and where do I configure props and transforms to forward a few events into a particular index by host?

Hi, I have 4 forwarders, 4 search heads, and 2 forwarders in my Splunk cluster. Now one of the forwarders is confi...

by Path Finder in

assign sourcetype based upon file name

Hi, Is there a way to dynamically assign sourcetype based upon input filename?

by Champion in

How to configure props.conf for proper line breaking of Syslog data in Splunk?

Our syslog data in Splunk is showing up with at least 1% of the results with incorrect line breaking. We have tried t...

by Explorer in

Is there a bug in Splunk 6 with adding an attribute of an object in data models for a JSON field name containing curly brackets?

I'm trying to create an object and add some auto-extracted attributes. Some field names contain curly braces because ...

by Engager in

How to configure Splunk to ignore a timestamp to count two lines of data as one event?

Here is a sampling of the log data. Lines 1-3 had no issues, but line 4 issues a warning and dumps the problem onto l...

by Communicator in

Get Updates on the Splunk Community!

Getting Data In

Discussions

XML tag extraction

Are events from a particular source not getting indexed every night from 8pm to 12am, but events show up 24 hour later?

How to collect Microsoft Web Application Proxy logs from a remote host?

Is the search I'm giving my transaction too broad? I get results with an additional filter on the initial search, but no results if I remove the filter.

How do I set up Splunk Enterprise Linux to ingest Windows logs that are not part of the universal forwarder install?

How to configure inputs.conf to monitor evtx files from a UNC path?

Why am I getting "memPartAlloc: block too big" sending my SIP phone syslog to universal forwarders?

How to monitor a folder for newest files only? (files with a change date of 2015, and then only monitor changes after that)

Which server/port/config used for log receive on splunk light like *.cloud.splunk.com?

If passing a parameter from main dashboard to next view, how to show this parameter as read only in the label or input type field?

How to setup "Metadata" characteristics in Splunk DB connect V2, for the query results received from Microsoft SQL Server 2012?

An update was made to the identities.csv and now I'm not seeing the expected result count. What is going on?

If I have 70+ devices writing data to UDP port 514, how do I route 5 IP addresses to one index, and the rest to another index?

Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Splunk overwrites outputs.conf and inputs.conf on reboot

When will search head clustering be available for windows? (Officially Supported)

Splunk is adding weird strings like "_linebreaker\x00\x00" to my events, what is going on?

Why does configuring props.conf with DATETIME_CONFIG = NONE cause less events to be indexed from Tomcat logs?

Getting Error while doing MS Sql connection : Encountered the following error while trying to save: In handler 'databases': Error connecting to database: java.sql.SQLException: Network error IOException: Connection refused: connect

Can I add an Index-Cluster to a Multisite-Index-Cluster

How and where do I configure props and transforms to forward a few events into a particular index by host?

assign sourcetype based upon file name

How to configure props.conf for proper line breaking of Syslog data in Splunk?

Is there a bug in Splunk 6 with adding an attribute of an object in data models for a JSON field name containing curly brackets?

How to configure Splunk to ignore a timestamp to count two lines of data as one event?

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

Configuring Splunk OTel Collector for Linux/Window...

Upload failed with ERROR: Read Timeout

Splunk DB connect to Splunk

incomplete field extraction

DB Connect SQL Procedures