Getting Data In

Discussions

Thread Info

parsing specific area of a field

Hello all, just wondering if it is possible and how to do the following search? Got a field with URLs ( for exa...

by New Member in

Why is our props.conf configuration for our universal forwarder and clustered indexers not breaking events properly?

We have a few access log files from our SecureMedia application that we are attempting to ingest. I've been able to g...

by Communicator in

Is it possible to have a Splunk universal forwarder read a growing file and delete it when it's done?

Howdy, I want to ingest files on a universal forwarder that are still being written, and to delete them once the f...

by Path Finder in

How to troubleshoot why one forwarder "could not send data to output queue" after upgrading to Splunk 6.2.2?

Hey Guys I have a right one here. So I have a bunch of systems in a DMZ forwarding to a heavy forwarder that then ...

by Communicator in

Is my process to add cold storage to my Splunk 6.2.2 indexer clustering setup correct?

I'm looking to add cold storage to my Splunk 6.2.2 indexer clustering setup and just wanted to verify my process was ...

by Explorer in

Why is my TCP Input data being cut off? Is there a limit I can configure?

Hello experts, I am using the TCP input "channel" in order to get data into splunk (inputs.conf): [tcp://558] c...

by Explorer in

After creating and setting a new index in inputs.conf on the universal forwarder, why do I see no search results on the search head?

I'm trying to create a new index called 'winevents_endpoint'. I've added this index to the Search Head, Indexer, and ...

by Path Finder in

how to find n th line data using rex

Hi, how to find nth line data in an event. for example: I have to get 7th line data and needs to correlate with th...

by Contributor in

Active forwards don't forward data to Splunk Cloud instance

I use username: admin and password: changeme to log in to my Splunk universal forwarder. I am trying to forward logs ...

by Explorer in

How to push Windows event and security logs to a *NIX Splunk server without deploying forwarders on the Windows servers?

According to my understanding, WMI as a pull agent is available on Windows' deployment of Splunk only. What are t...

by New Member in

Why is the same timestamp getting indexed differently in two different Splunk servers?

Hi, I am using DBConnect to fetch two timestamps from an Oracle database table, let's call them TS1 and TS2, havin...

by Path Finder in

Why am I unable to install the Splunk 6.2.3 free version on a Windows 7 64 bit machine with error "setup wizard ended prematurely..."

When I start installation process, it copies files and at the end point. it starts a roll back action and gives an er...

by Engager in

How to permanently adjust the timezone for IIS logs in Splunk Light on Windows?

Hi, I am using Splunk Light for Windows, and I have imported some IIS Logs files, but the timezone is out by an ho...

by New Member in

How to index data from the directory based on the log created date in SPLUNK?

Hi Team, I have a couple of logs to be monitored daily from a directory called LOG. The log name is error log.0, e...

by Path Finder in

How to configure my Marimba data input on a heavy forwarder to filter out some of the monitored logs?

I am currently trying to use my Marimba data gathered from the Endpoint tuner in Splunk. On my Universal Forwarder, I...

by Path Finder in

Make Splunk stop learning sourcetypes!

Hi In this setup, we have servers for each universal-forwarder -> forwarder -> indexer -> searchhead. I am test...

by Path Finder in

Windows host and source types not shown in search

I had to reinstall my universal forwarder on windows server and splunk stopped showing new messages. So deleted all m...

by Path Finder in

Monitor directory with wildcards but not recursively

Splunk documentation is incorrect, as it states you should be able to do something like this : [monitor:///ebs/*/v...

by Builder in

After upgrading from Splunk 6.1.3 to 6.2.1, why did universal forwarders stop sending logs that were specified with wildcards in the inputs.conf monitor stanzas?

I upgraded from 6.1.3 to 6.2.1 recently and noticed that some of my universal forwarders stopped sending certain logs...

by Explorer in

How to compare date time present in a log with the date time selected from the time range picker?

I have a log, which has two time fields, _time(Log indexed time)StartDate (Date time inside the log) When i se...

by New Member in

How to configure Splunk to convert multiple datetime attributes within the same data source to epoch at index-time and not treat them as strings?

Hi, In our data source (an application log file), we have multiple datetime attributes (say update_time, order_tim...

by Path Finder in

Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from?

I'm gathering data from two machines, and depending on which one it comes from, it has a different index. Both univer...

by Path Finder in

Is splunk supported forwarding log data from an IBM GPFS mount point?

We are running a small GPFS cluster on AIX. I am seeing high CPU usage running a universal forwarder pointed at log f...

by Explorer in

How to Access Splunk's REST API

I'm working on sending requests to Splunk's REST API for the first time and have a few questions after reading throug...

by Builder in

How to prevent scripted input grouping events by time?

I have a script that executes every 5 minutes. It extracts date and time with props.conf: EXTRACT-date = ^(?:[^\t\...

by Explorer in

Get Updates on the Splunk Community!

Getting Data In

Discussions

parsing specific area of a field

Why is our props.conf configuration for our universal forwarder and clustered indexers not breaking events properly?

Is it possible to have a Splunk universal forwarder read a growing file and delete it when it's done?

How to troubleshoot why one forwarder "could not send data to output queue" after upgrading to Splunk 6.2.2?

Is my process to add cold storage to my Splunk 6.2.2 indexer clustering setup correct?

Why is my TCP Input data being cut off? Is there a limit I can configure?

After creating and setting a new index in inputs.conf on the universal forwarder, why do I see no search results on the search head?

how to find n th line data using rex

Active forwards don't forward data to Splunk Cloud instance

How to push Windows event and security logs to a *NIX Splunk server without deploying forwarders on the Windows servers?

Why is the same timestamp getting indexed differently in two different Splunk servers?

Why am I unable to install the Splunk 6.2.3 free version on a Windows 7 64 bit machine with error "setup wizard ended prematurely..."

How to permanently adjust the timezone for IIS logs in Splunk Light on Windows?

How to index data from the directory based on the log created date in SPLUNK?

How to configure my Marimba data input on a heavy forwarder to filter out some of the monitored logs?

Make Splunk stop learning sourcetypes!

Windows host and source types not shown in search

Monitor directory with wildcards but not recursively

After upgrading from Splunk 6.1.3 to 6.2.1, why did universal forwarders stop sending logs that were specified with wildcards in the inputs.conf monitor stanzas?

How to compare date time present in a log with the date time selected from the time range picker?

How to configure Splunk to convert multiple datetime attributes within the same data source to epoch at index-time and not treat them as strings?

Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from?

Is splunk supported forwarding log data from an IBM GPFS mount point?

How to Access Splunk's REST API

How to prevent scripted input grouping events by time?

Enterprise Security Content Update (ESCU) | New Releases

Index This | Divide 100 by half. What do you get?

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

AWS VPC Flow logs getting ingested non-human reada...

Microsoft Teams Add-On for Splunk - Missing Webhoo...

Configuring Splunk OTel Collector for Linux/Window...

Upload failed with ERROR: Read Timeout

Splunk DB connect to Splunk