Getting Data In

Community Activity

Why am I unable to forward logs from a Linux machine to Windows using Splunk 6.3? I am new to Splunk and downloaded Splunk free to several machines, Linux and Windows. All machines are on the same s... by CREVITCH Path Finder in Getting Data In 10-27-2015 0 3	0	3
How limit my index growth Hi Splunk Users, I am having an issue with my indexes growing very large and clogging up the space on my disk. For ... by omuelle1 Communicator in Getting Data In 10-27-2015 0 3	0	3
When creating a dashboard to create a list of windows log sources how do you get it to escape the \ characters within the dashboard When doing this via the search bar index=xxxx \| chart count by source, when you select a source in search it automa... by mux Explorer in Getting Data In 10-27-2015 0 7	0	7
Is it possible to use Splunk on a Windows machine as a cluster master for Splunk indexers on Linux machines? Hi. I have an environment with two Splunk indexers running on VMs with Linux OS, and I want to create an indexer cl... by hettervik SplunkTrust in Getting Data In 10-27-2015 0 2	0	2
Is there a way to find out all the indexers and forwarders in our Splunk environment via Splunk Web or CLI? It would be great if someone can help me get this answer, either in GUI or CLI (through commands). Thank you in advan... by japala Path Finder in Getting Data In 10-26-2015 1 3	1	3
How to set the site during Universal Forwarder installation for a Splunk 6.3 multisite indexer cluster? I am deploying Universal Forwarders by either Puppet or SCCM to multiple hosts. They will be forwarding to a 6.3.0 m... by karlbosanquet Path Finder in Getting Data In 10-26-2015 0 2	0	2
Duplicate data problem Hi I have the following configuration in inputs.conf: [monitor:///<directory>] index=results crcSalt = <SOURCE> sou... by edrivera3 Builder in Getting Data In 10-26-2015 0 9	0	9
Enabling export to csv button in web framework Hello, I am looking to enable an export to csv button in web framework (where you can hover over the bottom of a tab... by jamesvz84 Communicator in Getting Data In 10-26-2015 1 4	1	4
If I currently have a single Windows server running Splunk, how can I add a new Linux front end server to use apps that require Linux? Right now I have Splunk set up on a single Windows server, but have found some apps that require a Linux server to ru... by erickopp Engager in Getting Data In 10-26-2015 0 1	0	1
How can I parse 2 sets of CSVs in one file? How could I parse this? section1String field1,field2,field3 value1,value2,value3 value1,value2,value3 value1,value2,... by hylam Contributor in Getting Data In 10-26-2015 0 7	0	7
Adding Data from a forwarder, why am I getting error "There are currently no forwarders configured as deployment clients to this instance"? I just installed a forwarder on a host and trying to connect it to the Enterprise server, but got an error when launc... by fademidun Engager in Getting Data In 10-26-2015 1 1	1	1
Aside from disabling Redhat's Out of Memory (OOM) Manager that is killing splunkd, is there any other way to manage the splunk-optimize process to reduce the memory it uses? Splunk-optimize is launching on our indexers and eating up a few GB of memory, then Redhat's out-of-memory manager ki... by rsolutions Path Finder in Getting Data In 10-26-2015 0 10	0	10
How can I locate the actual source of events? I have a sourcetype that has a non-descriptive host and a source defined (both appear to have been overwritten by sta... by zindain24 Path Finder in Getting Data In 10-26-2015 0 1	0	1
Implement Retention Policy Hi all, our customer want to implement a policy that track logs of the last six months starting from the time in whic... by a5003976 Explorer in Getting Data In 10-26-2015 0 9	0	9
What options are there to find if a forwarder has stopped sending data to our Splunk server? Hi, Is there any way or any work around or any app through which I can know if Splunk stop receiving data from the f... by sunnyparmar Communicator in Getting Data In 10-25-2015 1 6	1	6
what happens to the data forwarded to indexer when the index is not present ? Sample Warning Message: Search peer 10.0.1.1 has the following message: received event for unconfigured/disabled/del... by splunker12er Motivator in Getting Data In 10-24-2015 0 2	0	2
Getting two time stamps in a syslog entry - how to correct Hey all. Trying to figure out how to clear up my issue. I'm getting two separate time stamps on a syslog entry comin... by thecoffeeguy14 New Member in Getting Data In 10-24-2015 0 4	0	4
Extracting sourcetype from source /tmp/csv/file1 The sourcetype should be csv or tsv or psv, depending on the full path in the source field. For hosts we have host_re... by hylam Contributor in Getting Data In 10-24-2015 0 1	0	1
Trouble indexing Amanda (backup) JSON files into Splunk I have added the following to my props.conf file. AMANDA JSON FILES [amanda] INDEXED_EXTRACTIONS = json KV_MODE = j... by khhenderson Path Finder in Getting Data In 10-24-2015 0 3	0	3
blacklist an event id 4670 with task category: Authorization Policy Change Hi, I am trying to blacklist an event id 4670 with task category: Authorization Policy Change I've tried: blacklist... by nathanpyun Explorer in Getting Data In 10-23-2015 0 2	0	2
Where does forwarded data exist if the index mentioned in my inputs.conf monitor stanza was not created? Hello Everyone, I have created an inputs.conf file for deploying an app in host machine to forward data. [monitor:... by snehal8 Path Finder in Getting Data In 10-23-2015 0 6	0	6
If I have 2 identical inputs.conf monitor stanzas except for the target indexes, will data be received in both indexes or only the first? Hello, I just had a quick question about the inputs.conf file in the Splunk Universal Forwarders. Let's say, I have... by mmensch Path Finder in Getting Data In 10-23-2015 0 2	0	2
How does one fix the multiple Forwarders with same GUID issue on Windows boxes? Everyone, Here is my situation. I set up one Windows box with a Universal Forwarder, V6.3. This one forwarder was ... by OldManEd Builder in Getting Data In 10-23-2015 0 3	0	3
running a script for creating a report hi, We have scheduled scripts. I don't want to create a scheduled script but run the script on demand. i.e. run the ... by praspai Path Finder in Getting Data In 10-23-2015 0 1	0	1
Time format in email alert Search AAA\|\|rename _time as UpTime \|fieldformat UpTime=strftime(UpTime, "%D %H:%M:%S") \|Table UpTime Info It works w... by AllenZhang Explorer in Getting Data In 10-23-2015 0 1	0	1

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...

Getting Data In

Why am I unable to forward logs from a Linux machine to Windows using Splunk 6.3?

How limit my index growth

When creating a dashboard to create a list of windows log sources how do you get it to escape the \ characters within the dashboard

Is it possible to use Splunk on a Windows machine as a cluster master for Splunk indexers on Linux machines?

Is there a way to find out all the indexers and forwarders in our Splunk environment via Splunk Web or CLI?

How to set the site during Universal Forwarder installation for a Splunk 6.3 multisite indexer cluster?

Duplicate data problem

Enabling export to csv button in web framework

If I currently have a single Windows server running Splunk, how can I add a new Linux front end server to use apps that require Linux?

How can I parse 2 sets of CSVs in one file?

Adding Data from a forwarder, why am I getting error "There are currently no forwarders configured as deployment clients to this instance"?

Aside from disabling Redhat's Out of Memory (OOM) Manager that is killing splunkd, is there any other way to manage the splunk-optimize process to reduce the memory it uses?

How can I locate the actual source of events?

Implement Retention Policy

What options are there to find if a forwarder has stopped sending data to our Splunk server?

what happens to the data forwarded to indexer when the index is not present ?

Getting two time stamps in a syslog entry - how to correct

Extracting sourcetype from source /tmp/csv/file1

Trouble indexing Amanda (backup) JSON files into Splunk

blacklist an event id 4670 with task category: Authorization Policy Change

Where does forwarded data exist if the index mentioned in my inputs.conf monitor stanza was not created?

If I have 2 identical inputs.conf monitor stanzas except for the target indexes, will data be received in both indexes or only the first?

How does one fix the multiple Forwarders with same GUID issue on Windows boxes?

running a script for creating a report

Time format in email alert

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Issue facing while installing Splunk Add-on for AW...

Google workspace Meet logs

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

Getting Data In

Join the Conversation