Getting Data In

Community Activity

After creating and setting a new index in inputs.conf on the universal forwarder, why do I see no search results on the search head? I'm trying to create a new index called 'winevents_endpoint'. I've added this index to the Search Head, Indexer, and ... by nce054 Path Finder in Getting Data In 06-23-2015 1 10	1	10
how to find n th line data using rex Hi, how to find nth line data in an event. for example: I have to get 7th line data and needs to correlate with the ... by srinathd Contributor in Getting Data In 06-23-2015 0 2	0	2
Active forwards don't forward data to Splunk Cloud instance I use username: admin and password: changeme to log in to my Splunk universal forwarder. I am trying to forward logs... by johnwl Explorer in Getting Data In 06-22-2015 0 7	0	7
How to push Windows event and security logs to a *NIX Splunk server without deploying forwarders on the Windows servers? According to my understanding, WMI as a pull agent is available on Windows' deployment of Splunk only. What are the... by judenaidoo New Member in Getting Data In 06-22-2015 0 2	0	2
Why is the same timestamp getting indexed differently in two different Splunk servers? Hi, I am using DBConnect to fetch two timestamps from an Oracle database table, let's call them TS1 and TS2, having ... by SwatiApte Path Finder in Getting Data In 06-22-2015 0 15	0	15
Why am I unable to install the Splunk 6.2.3 free version on a Windows 7 64 bit machine with error "setup wizard ended prematurely..." When I start installation process, it copies files and at the end point. it starts a roll back action and gives an er... by kulamani Engager in Getting Data In 06-22-2015 0 1	0	1
How to permanently adjust the timezone for IIS logs in Splunk Light on Windows? Hi, I am using Splunk Light for Windows, and I have imported some IIS Logs files, but the timezone is out by an hour... by johnc_ncc New Member in Getting Data In 06-22-2015 0 1	0	1
How to index data from the directory based on the log created date in SPLUNK? Hi Team, I have a couple of logs to be monitored daily from a directory called LOG. The log name is error log.0, err... by deepthi5 Path Finder in Getting Data In 06-22-2015 0 1	0	1
How to configure my Marimba data input on a heavy forwarder to filter out some of the monitored logs? I am currently trying to use my Marimba data gathered from the Endpoint tuner in Splunk. On my Universal Forwarder, I... by nce054 Path Finder in Getting Data In 06-22-2015 0 5	0	5
Make Splunk stop learning sourcetypes! Hi In this setup, we have servers for each universal-forwarder -> forwarder -> indexer -> searchhead. I am testing ... by lsolberg Path Finder in Getting Data In 06-21-2015 3 1	3	1
Windows host and source types not shown in search I had to reinstall my universal forwarder on windows server and splunk stopped showing new messages. So deleted all m... by thejohn Path Finder in Getting Data In 06-21-2015 0 4	0	4
Monitor directory with wildcards but not recursively Splunk documentation is incorrect, as it states you should be able to do something like this : [monitor:///ebs/*/var... by Cuyose Builder in Getting Data In 06-21-2015 0 1	0	1
After upgrading from Splunk 6.1.3 to 6.2.1, why did universal forwarders stop sending logs that were specified with wildcards in the inputs.conf monitor stanzas? I upgraded from 6.1.3 to 6.2.1 recently and noticed that some of my universal forwarders stopped sending certain logs... by mikehodges01 Explorer in Getting Data In 06-21-2015 0 1	0	1
How to compare date time present in a log with the date time selected from the time range picker? I have a log, which has two time fields, _time(Log indexed time)StartDate (Date time inside the log) When i select... by shannu1241 New Member in Getting Data In 06-20-2015 0 1	0	1
How to configure Splunk to convert multiple datetime attributes within the same data source to epoch at index-time and not treat them as strings? Hi, In our data source (an application log file), we have multiple datetime attributes (say update_time, order_time,... by SwatiApte Path Finder in Getting Data In 06-19-2015 0 1	0	1
Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from? I'm gathering data from two machines, and depending on which one it comes from, it has a different index. Both univer... by nce054 Path Finder in Getting Data In 06-19-2015 0 3	0	3
Is splunk supported forwarding log data from an IBM GPFS mount point? We are running a small GPFS cluster on AIX. I am seeing high CPU usage running a universal forwarder pointed at log f... by sseekamp Explorer in Getting Data In 06-19-2015 3 5	3	5
How to Access Splunk's REST API I'm working on sending requests to Splunk's REST API for the first time and have a few questions after reading throug... by _gkollias Builder in Getting Data In 06-19-2015 0 6	0	6
How to prevent scripted input grouping events by time? I have a script that executes every 5 minutes. It extracts date and time with props.conf: EXTRACT-date = ^(?:[^\t\n]... by temperuser Explorer in Getting Data In 06-19-2015 0 1	0	1
Query - to get actual rentention period set & remaining days left for rentention Splunk query to get , Actual retention set for an index Remaining days left to meet retention date Current Index_siz... by splunker12er Motivator in Getting Data In 06-19-2015 0 1	0	1
Timestamp conversion to epoch time. I have a timestamp in the format "19-06-2015 07:00:00 Europe/London". Is there a way to convert this timestamp to epo... by AditiKulkarni New Member in Getting Data In 06-19-2015 0 1	0	1
Splunk process is stopping due to the clash with ARCHIVAL script. Can Splunk read a log file while it is getting gzipped? Hi Team, I have a splunk forwarder on a Linux Websphere machine. I have an archival script which triggers daily at a... by adiga20 New Member in Getting Data In 06-19-2015 0 3	0	3
Why is my line breaking for Twitter data not working reliably? I am working on Twitter Data in JSON format, basically the way you get it from the 1% sample stream UPDATE: not quite... by jeffland SplunkTrust in Getting Data In 06-18-2015 0 13	0	13
Is setting up bloom filters still recommended in Splunk 6.2.3? hello, Is setting up Bloom Filters still recommended under 6.23? I am hearing conflicting statements about if they ... by daniel333 Builder in Getting Data In 06-18-2015 1 2	1	2
Getting MongoDB data into Splunk on Date rising column Update on June 24, 2015 I've tried switching to _id column from my mongo db as my rising column; it again works the ... by zvaseqi Explorer in Getting Data In 06-18-2015 1 2	1	2

Get Updates on the Splunk Community!

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Introducing ITSI 5.0: Unified Visibility and Actionable Insights Tuesday, July 21, 2026 | 10:00AM PT / ...

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

Inside Splunk Agent Observability:Understanding Agent Behavior, Tokens & Costs Thursday, August 06, ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Getting Data In

After creating and setting a new index in inputs.conf on the universal forwarder, why do I see no search results on the search head?

how to find n th line data using rex

Active forwards don't forward data to Splunk Cloud instance

How to push Windows event and security logs to a *NIX Splunk server without deploying forwarders on the Windows servers?

Why is the same timestamp getting indexed differently in two different Splunk servers?

Why am I unable to install the Splunk 6.2.3 free version on a Windows 7 64 bit machine with error "setup wizard ended prematurely..."

How to permanently adjust the timezone for IIS logs in Splunk Light on Windows?

How to index data from the directory based on the log created date in SPLUNK?

How to configure my Marimba data input on a heavy forwarder to filter out some of the monitored logs?

Make Splunk stop learning sourcetypes!

Windows host and source types not shown in search

Monitor directory with wildcards but not recursively

After upgrading from Splunk 6.1.3 to 6.2.1, why did universal forwarders stop sending logs that were specified with wildcards in the inputs.conf monitor stanzas?

How to compare date time present in a log with the date time selected from the time range picker?

How to configure Splunk to convert multiple datetime attributes within the same data source to epoch at index-time and not treat them as strings?

Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from?

Is splunk supported forwarding log data from an IBM GPFS mount point?

How to Access Splunk's REST API

How to prevent scripted input grouping events by time?

Query - to get actual rentention period set & remaining days left for rentention

Timestamp conversion to epoch time.

Splunk process is stopping due to the clash with ARCHIVAL script. Can Splunk read a log file while it is getting gzipped?

Why is my line breaking for Twitter data not working reliably?

Is setting up bloom filters still recommended in Splunk 6.2.3?

Getting MongoDB data into Splunk on Date rising column

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

How to integrate threat armor with splunk?

How to integrate Google Cloud armor with splunk?

Getting Data In

Join the Conversation