Getting Data In

Community Activity

After upgrading our Splunk indexers from 6.2.2 to 6.2.4, why did the splunkd service stop twice and had to be restarted? Hello, Two days ago, we upgraded the Splunk version on our indexers from 6.2.2. to 6.2.4. However, we are facing an ... by arber Communicator in Getting Data In 08-21-2015 0 4	0	4
How do I configure Splunk to recognize the non-standard timestamp format in my log file? Hi All, I'm trying to Upload a file/log using the 'Add Data' -> 'upload' in Splunk Web. Unfortunately, as per most o... by markwymer Path Finder in Getting Data In 08-21-2015 0 5	0	5
Indexing process Hi guys! How can I look at indexing process? Can I see what splunk is indexing file by file. Because it looks like b... by dimoobraznii Path Finder in Getting Data In 08-21-2015 0 1	0	1
How do I index a simple http URL request in Splunk Light? Our web PHP error and access logs are available only at a simple http URL request. How can I get these into Splunk Li... by jedashford New Member in Getting Data In 08-20-2015 0 3	0	3
Syslog File Monitor - Issues with multiple monitor paths For some reason the inputs.conf is not liking how I am giving it two monitor paths with wildcards in the same set of ... by fairje Communicator in Getting Data In 08-20-2015 0 3	0	3
Why are my UDP inputs not showing up in my metrics.log? Hi all, I would like to know.... I have a functional index named "phone" I have 120 IP (with no host) defined in in... by rene847 Path Finder in Getting Data In 08-20-2015 0 2	0	2
If I have an application writing the same logs to two servers, can we run a forwarder on both and configure an indexer to only index events from one? I have an application which writes the same log to two servers. They act as each other's backup during maintenance sc... by shailesh030 Path Finder in Getting Data In 08-20-2015 0 3	0	3
Do you have any recommendations for Universal forwarder settings that would ease the resource usage for Universal Forwarders loaded on AWS micro servers? One of our user applications utilizes over 50% Micro Servers in AWS. The micros meet the minimum requirements for Sp... by jpt751 New Member in Getting Data In 08-19-2015 0 2	0	2
Filter Events per EventID Hi Splunkers, I am relatively new to splunk so I just have an basic knowledge and I apologize if my question is ans... by mlb19 Explorer in Getting Data In 08-19-2015 0 9	0	9
Indexer not filtering forwarded events So. We have recently changed MSSPs, and we are going to be forwarding events to them from our Splunk instance. We h... by keenerms Engager in Getting Data In 08-19-2015 0 2	0	2
Dealing with key/value pairs with inconsistent key case Our set up is like this.. On all of our servers, we collect a "contacts" file we use to keep track of what function ... by Ricapar Communicator in Getting Data In 08-19-2015 3 5	3	5
Is it possible to change the default output CSV file location/path? Hi Exports , I need to find a way to export the csv file to a specific location/path after searching. Somebody sai... by jackywsy Explorer in Getting Data In 08-18-2015 0 1	0	1
How to use 24-hour clock in the US Local? Using SPLUNK 6.2.1 - How do I display all my date/times using the 24-hour clock? I want to keep the US Local for the... by lyndac Contributor in Getting Data In 08-18-2015 0 3	0	3
Upgrading Splunk from 6.2.3 to 6.2.5 on Windows, why is the installation hanging? Hi All, I am attempting to upgrade Splunk from 6.2.3 to 6.2.5. I have followed the URL below and have started upda... by domenico_perre Path Finder in Getting Data In 08-18-2015 0 3	0	3
Add field to event before indexing I have a dashboard that analysts use to quickly triage events. Within this dashboard I have several panels that sepa... by IngloriousSplun Communicator in Getting Data In 08-18-2015 0 8	0	8
How do i stop a file from being segmented? This is the beginning of the file, line numbers for clarity: 1. Log File for: BatchJobOutput_20150801-0139_13516_Mont... by MikeBertelsen Communicator in Getting Data In 08-18-2015 0 10	0	10
Can I use Splunk to monitor devices connected to a wireless router in my household? I am a rookie and need help. I want to monitor what people are doing online in my household. Netgear router--WNDR370... by teddyzena Engager in Getting Data In 08-18-2015 2 1	2	1
Why do I get "Splunk is not running" trying to run "list monitor" on my forwarder, and I can't stop splunk with error "Could not kill pid 379. [FAILED]"? I can't list monitor my forwarder. I obtain "splunk is not running" even if the splunk status says it is running. So... by efrenette11 Path Finder in Getting Data In 08-18-2015 0 4	0	4
Universal Forwarder High CPU after Leap Second Correction This is an FYI to anyone else that may be seeing abnormally high CPU utilization on their universal forwarders over t... by gcoles Communicator in Getting Data In 08-17-2015 9 11	9	11
Network latency Regardless of one's approach with collecting data, Splunk is heavily dependent on the network. How does one deal wit... by peter_gianusso Communicator in Getting Data In 08-17-2015 0 3	0	3
When a scheduled search spans multiple indexers in different timezones, is there a way to force the location which determines where the beginning of the day snap time (@d) is? Consider a search which spans events in indexes in London and New-York. \| mysearch \| bucket _time span=1d \| stats co... by manus Communicator in Getting Data In 08-17-2015 0 5	0	5
Exporting data from Splunk to Tableau over ODBC, is there a way to clean up the data (remove quotation marks) before the export? Hi guys! We’re trying to export data from Splunk over to Tableau over ODBC. We’ve successfully managed to export/imp... by bearman Explorer in Getting Data In 08-17-2015 0 3	0	3
Monitoring syslog-ng on same local Splunk server, is it possible to trigger an email when specific keywords are seen? I have syslog-ng logging some Cisco equipment, specifically ISDN q931 debugs. These log files are created and labele... by kduckworth New Member in Getting Data In 08-17-2015 0 4	0	4
What props.conf change do I need to prevent incorrect line breaking of XML data on embedded timestamps? I have not made any props.conf changes before, so looking for some help please / thanks. I am pulling tomcat logs an... by dolejh76 Communicator in Getting Data In 08-14-2015 0 24	0	24
How to filter events based on event's datetime as current date? Hello! Sup? I've been into some trouble when comparing datetimes to strings, I know I should convert'em. Logs I've re... by vtsguerrero Contributor in Getting Data In 08-14-2015 0 2	0	2

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Getting Data In

After upgrading our Splunk indexers from 6.2.2 to 6.2.4, why did the splunkd service stop twice and had to be restarted?

How do I configure Splunk to recognize the non-standard timestamp format in my log file?

Indexing process

How do I index a simple http URL request in Splunk Light?

Syslog File Monitor - Issues with multiple monitor paths

Why are my UDP inputs not showing up in my metrics.log?

If I have an application writing the same logs to two servers, can we run a forwarder on both and configure an indexer to only index events from one?

Do you have any recommendations for Universal forwarder settings that would ease the resource usage for Universal Forwarders loaded on AWS micro servers?

Filter Events per EventID

Indexer not filtering forwarded events

Dealing with key/value pairs with inconsistent key case

Is it possible to change the default output CSV file location/path?

How to use 24-hour clock in the US Local?

Upgrading Splunk from 6.2.3 to 6.2.5 on Windows, why is the installation hanging?

Add field to event before indexing

How do i stop a file from being segmented?

Can I use Splunk to monitor devices connected to a wireless router in my household?

Why do I get "Splunk is not running" trying to run "list monitor" on my forwarder, and I can't stop splunk with error "Could not kill pid 379. [FAILED]"?

Universal Forwarder High CPU after Leap Second Correction

Network latency

When a scheduled search spans multiple indexers in different timezones, is there a way to force the location which determines where the beginning of the day snap time (@d) is?

Exporting data from Splunk to Tableau over ODBC, is there a way to clean up the data (remove quotation marks) before the export?

Monitoring syslog-ng on same local Splunk server, is it possible to trigger an email when specific keywords are seen?

What props.conf change do I need to prevent incorrect line breaking of XML data on embedded timestamps?

How to filter events based on event's datetime as current date?

Announcing Modern Navigation: A New Era of Splunk User Experience

Best Practices: Splunk auto adjust pipeline queue

Request for Professional Development: Attending .conf26

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

How to integrate threat armor with splunk?

How to integrate Google Cloud armor with splunk?

Getting Data In

Join the Conversation