Getting Data In

Ask a Question

Discussions

Thread Info

Adding Sourcetype causes no results to come back

Hello, I added a transform/props for my Juniper SRX firewall logs to get sourcetyped as juniper_sa. Worked right ...

by Builder in

how to identify the forwarder detail

I have 4 Farwarders sending data to indexes how to identify their details while searching

by Explorer in

Trying to set up a new OPSEC connection using pull-cert.sh, why am I getting "File ../certs/ already exists. Exiting."?

Hi, I'm trying to set up a new OPSEC connection and using the pull-cert.sh script, but it's telling me that "File ...

by Champion in

Can I forward to 2 splunkcloud deployments at a time ?

I have 1 splunkcloud deployment, and I need to send a copy of my data to another deployment. can the splunklcoud i...

by Splunk Employee in

How do I configure line breaking on the timestamp in my data?

Need to line break on timestamp in the following log record, but the underscore in the timestamp is throwing me off. ...

by Builder in

If one indexer of 6 is about to reach capacity in an indexer cluster. will remaining 5 still index?

One of my indexers is about to reach its storage capacity. I am trying to figure out if/when that happens, will A) al...

by Communicator in

Is it possible to use an index with a loadjob result to filter content?

Hii everybody, I want to know if it's possible to use an index with loadjob result. I have some values inside a...

by Contributor in

How to define inputs.conf to have 2 different kinds of files monitored in a directory containing wildcards?

Hi Guys, I have the files below in a directory /var/mtapps/ashl/logs/[folderA]/[folderB]/[folderC]/ (there are ma...

by New Member in

Does Splunk Index Everything on the Server?

I have 3 servers which process web service calls and are being indexed by Splunk. I specified their index in the inpu...

by SplunkTrust in

DB Connect 2 Py_dbinput failed

Dear Experts, Facing challenge to integrate the Mcafee Epo with splunk enterprise . We have installed the DB Co...

by Path Finder in

How to monitor an existing directory and upload all files in one shot?

I have directed my S3 storage logs to Splunk and its humming along nicely. Problem is, I have a lot of old logs on S3...

by Communicator in

Make Key=Value fields from _raw data during indextime

Hello I am trying to make key=value pair for the below data and I am lost on where I am going wrong.. 6/26/15 1...

by Motivator in

Is it possible to remove data from an event before indexing?

I've been asked to index a new sourcetype which is a set of XML-files. The files contains a tag <attachments>...<...

by Contributor in

Enterprise Trial + VMware app : licence quota quite exceeded : 17 550 345 400% !!!

Hello, I am quite new to splunk and installed an enterprise version for testing purpose. I also installed *nix add...

by New Member in

Why is my _TCP_ROUTING configuration not working as expected to send log files to two different Splunk instances?

Hi, I want to send my log files to two different Splunk instances, but the data is only only being sent to one of ...

by Path Finder in

Can I influence the dynamic options for filtering in pivot?

I still haven't taken to data models and pivot entirely, and now I have found another thing that annoyed me. Going...

by SplunkTrust in

Still seeing connection_host typos on universal forwarder version 6.0.5 in my custom app

I saw an answer that said this was corrected in 4.2 but I'm seeing this on 6.0.5 universal forwarder. Noticed the spe...

by Path Finder in

DB Connect 1: Why is the timezone not appearing correctly?

Hello All I have an issue with the TZ not appearing correctly. I have two different inputs coming in and both have...

by Contributor in

Why is Splunk assigning the same and wrong timestamp to thousands of indexed events?

Splunk n00b here. Our Splunk system was recently indexing the wrong timestamp. I made some alterations to props.co...

by New Member in

What is the best way to use a universal forwarder to monitor a file that overwrites itself at random periods throughout the day?

Hoping that someone has seen this before and might be able to help. I'm fairly new to SPLUNK and I am attempting t...

by New Member in

How do I disable monitoring on a server for a certain time period without stopping Splunk, but have the option to reenable monitor inputs later?

Hi, I have Splunk forwarder 6.1.x installed on my servers. Splunk monitoring (many alerts) has been set up for the...

by Contributor in

splunk is down after upgrade

hi, i had 2 splunk instance in one VM, when i tried to upgrade one of the version with ports 9000 and 7089, the other...

by Builder in

Date on first line of log - time in event - jump in 5 hours causes splunk to misinterpret timestamp

I'm trying to get logs time stamped correctly in Splunk. The format of the logs is one line per event, each line has ...

by Contributor in

Why are today's events showing as yesterday for certain events?

I have a forwarder configured to pull data from a local server as a generic single line sourcetype. The events in the...

by New Member in

How do I edit my props.conf for proper line breaking when indexing a CSV file with a large amount of quotes and newlines?

I have a csv file that's giving me a headache while trying to index it. It has 100+ columns, several of which are mak...

by Path Finder in

Get Updates on the Splunk Community!

Getting Data In

Discussions

Adding Sourcetype causes no results to come back

how to identify the forwarder detail

Trying to set up a new OPSEC connection using pull-cert.sh, why am I getting "File ../certs/ already exists. Exiting."?

Can I forward to 2 splunkcloud deployments at a time ?

How do I configure line breaking on the timestamp in my data?

If one indexer of 6 is about to reach capacity in an indexer cluster. will remaining 5 still index?

Is it possible to use an index with a loadjob result to filter content?

How to define inputs.conf to have 2 different kinds of files monitored in a directory containing wildcards?

Does Splunk Index Everything on the Server?

DB Connect 2 Py_dbinput failed

How to monitor an existing directory and upload all files in one shot?

Make Key=Value fields from _raw data during indextime

Is it possible to remove data from an event before indexing?

Enterprise Trial + VMware app : licence quota quite exceeded : 17 550 345 400% !!!

Why is my _TCP_ROUTING configuration not working as expected to send log files to two different Splunk instances?

Can I influence the dynamic options for filtering in pivot?

Still seeing connection_host typos on universal forwarder version 6.0.5 in my custom app

DB Connect 1: Why is the timezone not appearing correctly?

Why is Splunk assigning the same and wrong timestamp to thousands of indexed events?

What is the best way to use a universal forwarder to monitor a file that overwrites itself at random periods throughout the day?

How do I disable monitoring on a server for a certain time period without stopping Splunk, but have the option to reenable monitor inputs later?

splunk is down after upgrade

Date on first line of log - time in event - jump in 5 hours causes splunk to misinterpret timestamp

Why are today's events showing as yesterday for certain events?

How do I edit my props.conf for proper line breaking when indexing a CSV file with a large amount of quotes and newlines?

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

New Dates, New City: Save the Date for .conf25!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

OTEL splunk_hec receiver how to handle invalid tok...

Best Practices for Handling High-Cardinality Dimen...

WARN SSLCommon [53742 FwdDataReceiverThread] - Re...

What is the correct format for including the API k...

Configuring Splunk OTel Collector for Linux/Window...