Getting Data In

Community Activity

Extract timestamp from the date-time of the log file Hi, I have some log files with no timestamp neither in the indexed data nor in the path or filename. I don't want to... by laristote Explorer in Getting Data In 03-27-2015 0 2	0	2
Is it possible to set the default distributed search group on my search head to itself since it is also the indexer? Is it possible to set the default distributed search group to nothing but only search within itself (as my search hea... by karabsze Path Finder in Getting Data In 03-27-2015 1 1	1	1
Splunk 6.2 universal forwarder on Mac OSX 10.10.2? no data Hey All, I am new to Splunk and trying to gain some insight. I have an all mac home and I am trying to gain some insi... by kcarroll Explorer in Getting Data In 03-26-2015 1 4	1	4
_JSON sourcetype indexing data - timestamp recognition Hi all, I am attempting to index a .json formatted file. Using the Splunk data checker, the fields are all extracte... by himynamesdave Contributor in Getting Data In 03-26-2015 0 3	0	3
Fundamental issue with Splunk's architecture for overwriting other app's configuration I don't understand why Splunk implemented a priority architecture which can overwrite another app's property. I wante... by sibbsnb Path Finder in Getting Data In 03-26-2015 0 1	0	1
Blacklisting certain data from replicating in a bundle We are receiving replication failures several times a day between our searchhead and various indexers. From what I un... by ride76 Explorer in Getting Data In 03-26-2015 2 2	2	2
Java bridge not running - jbridge.log has SSL Exception Received fatal alert: bad_record_mac Splunk 6.1 and Splunk DB Connect 1.1.6 - Added java home path manually via config file, but java bridge wouldn't sta... by mcronkrite Splunk Employee in Getting Data In 03-26-2015 4 2	4	2
Can you Filter on remote servers prior to the log transfers to Splunk Indexer? Can I set up props.conf and transform.conf files on a remote server to null out entries in a log prior to them gettin... by agentguerry Path Finder in Getting Data In 03-25-2015 0 5	0	5
Best way to import geolocations info and use it in maps? I'm curious whether there is a preferred way of getting the geolocation data in and using it in the searches. We are ... by arkadyz1 Builder in Getting Data In 03-25-2015 0 3	0	3
How do I get a Splunk script to run on all universal forwarders in my environment? I'm trying to get a script to run on all of the servers I have universal forwarders on. When I setup my script I went... by akelly4 Path Finder in Getting Data In 03-25-2015 2 1	2	1
Splunk to monitor cPanel WHM web servers running on CentOS5.5 Has anyone used configured splunk to monitor their WHM /cPanel web servers. Did they encounter any problems with the ... by mobcdi New Member in Getting Data In 03-25-2015 0 3	0	3
How to compare a list of disabled users from Source A to a list of application users from Source B, both with different field names for the user account? Hi, the purpose of my search would be to compare two sources (they are both CSV files) to ensure there are no disable... by kgreat Path Finder in Getting Data In 03-24-2015 2 9	2	9
How to create an app with forwarder and index configurations and push out these configs to collect data? I want to create an app with forwarder and index configurations and push these configs to collect data from a particu... by sundaresh83 Explorer in Getting Data In 03-24-2015 2 1	2	1
Are "_meta"-entries still supported in inputs.conf? I've configured inputs.conf on a universal forwarder with [monitor:///somefile.log] _meta = testkey::testvalue [moni... by mikaeln Engager in Getting Data In 03-24-2015 3 2	3	2
How to edit my universal forwarder's monitor configuration for a single log file to prevent indexing events over and over again? Hello, We try to monitor a single Logfile with a Splunk Universal Forwarder on a Windows Server 2008 R2 Server. In t... by lukas_loder Communicator in Getting Data In 03-24-2015 0 3	0	3
After indexing slowed down due to available space, how can I speed up Splunk forwarding and indexing to catch up? There was a problem with available space for indexing and it had slowed down. But once the problem was fixed, the ind... by shailesh030 Path Finder in Getting Data In 03-24-2015 0 4	0	4
The lines of some json are joining My logs are joining in some events and with that I'm missing values that I later adding, for splunk only counts as va... by dbrancaglion Explorer in Getting Data In 03-24-2015 0 2	0	2
splitting /splunk/frozen volume Hi, In my environment we have so many index servers Eg:8 idx servers. All servers are mounted with one nfs volume ca... by splunkdeploy New Member in Getting Data In 03-24-2015 0 5	0	5
IOSTAT How do i get Disk iops out? Im hoping this is a simple one but its driving me mad! Comparing CPU usage against Disk iops. Using iostat as the s... by rob3770 Explorer in Getting Data In 03-24-2015 1 1	1	1
Why is FSChange (file system change monitor) a deprecated feature in Splunk 5.0? Why is FSChange a deprecated feature in Splunk 5.0? by BP9906 Builder in Getting Data In 03-24-2015 20 12	20	12
Is it possible to open a txt file from the Splunk framework and write on it? Hi everyone, Can I open a file from the splunk framework, a txt file, and write on it? Thank you, by Federica_92 Communicator in Getting Data In 03-24-2015 0 7	0	7
Read error. Either the application has not called WSAStartup, or WSAStartup failed. I am getting the below error in splunkd.log 04-16-2014 05:20:42.782 +0000 ERROR TcpOutputFd - Read error. Either the... by splunker12er Motivator in Getting Data In 03-24-2015 0 6	0	6
Splunk DB Connect: How to configure an input to properly index a database column that can have a multiline field? Hello , I am using Splunk DB Connect to input data to an index in splunk. I have the raw data below that I can obta... by danisam New Member in Getting Data In 03-23-2015 0 3	0	3
Splunk 6.1 upgrade - "Splunk Installer was unable to set the CACLS on the Splunk files. Exitcode='13' I upgraded from 6.0 to 6.1 this morning and received the following message in a window titled "Force ACLs": Splunk I... by wpreston Motivator in Getting Data In 03-23-2015 4 10	4	10
Windows eventlog can not be collected by Universal Forwarder I have some windows machine to collect their eventlog, most of them works fine, but several of them can not send data... by jichen Explorer in Getting Data In 03-23-2015 0 3	0	3

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...

Getting Data In

Extract timestamp from the date-time of the log file

Is it possible to set the default distributed search group on my search head to itself since it is also the indexer?

Splunk 6.2 universal forwarder on Mac OSX 10.10.2? no data

_JSON sourcetype indexing data - timestamp recognition

Fundamental issue with Splunk's architecture for overwriting other app's configuration

Blacklisting certain data from replicating in a bundle

Java bridge not running - jbridge.log has SSL Exception Received fatal alert: bad_record_mac

Can you Filter on remote servers prior to the log transfers to Splunk Indexer?

Best way to import geolocations info and use it in maps?

How do I get a Splunk script to run on all universal forwarders in my environment?

Splunk to monitor cPanel WHM web servers running on CentOS5.5

How to compare a list of disabled users from Source A to a list of application users from Source B, both with different field names for the user account?

How to create an app with forwarder and index configurations and push out these configs to collect data?

Are "_meta"-entries still supported in inputs.conf?

How to edit my universal forwarder's monitor configuration for a single log file to prevent indexing events over and over again?

After indexing slowed down due to available space, how can I speed up Splunk forwarding and indexing to catch up?

The lines of some json are joining

splitting /splunk/frozen volume

IOSTAT How do i get Disk iops out?

Why is FSChange (file system change monitor) a deprecated feature in Splunk 5.0?

Is it possible to open a txt file from the Splunk framework and write on it?

Read error. Either the application has not called WSAStartup, or WSAStartup failed.

Splunk DB Connect: How to configure an input to properly index a database column that can have a multiline field?

Splunk 6.1 upgrade - "Splunk Installer was unable to set the CACLS on the Splunk files. Exitcode='13'

Windows eventlog can not be collected by Universal Forwarder

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Issue facing while installing Splunk Add-on for AW...

Google workspace Meet logs

CiscoSecurityCloud TA 3.6.7 -eStreamer ingestion f...

SC4S postfilter not dropping Fortigate east-west t...

Transilience AI threat intel feed integration

Getting Data In

Join the Conversation