Getting Data In

Community Activity

Why is my Splunk Heavy Forwarder still indexing events Hi, I have set up a Splunk Heavy Forwarder (v6.1.1) that collects events from a number of Windows and Linux servers ... by ic_101 Explorer in Getting Data In 02-16-2015 2 6	2	6
What log4j ConversionPattern should I use to match splunk log4j sourcetype? I have a webapp running in Tomcat. I'm using Log4j for my logging, and whenever I load the .log file in Splunk it is ... by twhitbeck Engager in Getting Data In 02-15-2015 3 2	3	2
Asteriks and inputs.conf Hello, I have the following path /foo/bar[1-n]/logs/ I have several bar folders (bar1,bar2 ... bar1337 ) and inside ... by fcastro86 New Member in Getting Data In 02-15-2015 0 3	0	3
How to send syslog data to a specific index based on a string in the log? I have syslog data coming to a distributed environment. I am trying to send the data to a specific index based on a ... by hlarimer Communicator in Getting Data In 02-14-2015 0 6	0	6
How do you request customer_identifier_all_forwarder_outputs.zip? Does anyone know how to re-trigger the "Welcome to Splunk!" e-mail referenced in this documentation? http://docs.splu... by fsalamo Explorer in Getting Data In 02-14-2015 0 2	0	2
GUI not showing all field extractions from props.conf When I add search time Extractions directly to /opt/splunk/etc/apps/search/local/props.conf they will be used at sear... by hlarimer Communicator in Getting Data In 02-14-2015 0 1	0	1
How to troubleshoot why 1 of 2 files is no longer getting indexed after updating glibc and restarting our heavy forwarders using Splunk 5.0.11? Hi. This is regarding Splunk 5.0.11 Universal Forwarder and Heavy Forwarder. We rebooted 2 Heavy Forwarders today (... by Sqig Path Finder in Getting Data In 02-13-2015 0 2	0	2
Event filtering is not working as expected... what's missing? I am pulling my hair off on this one. I am trying to remove from the windows firewall logs all the IPv6 link local an... by cmlombardo Path Finder in Getting Data In 02-13-2015 0 1	0	1
How to blacklist files in my data input where the filename has a .bin extension? I have a directory with filenames like the ones below and want to blacklist the files in my data input where the file... by andersonwes New Member in Getting Data In 02-13-2015 0 4	0	4
Splunk DB Connect: Why can't I get java bridge to run after configuring splunkd to use SSL with syntax copied from the release notes? After configuring splunkd to use SSL, with /etc/system/local/server.conf [sslConfig] enableSplunkdSSL = true sslVe... by sjh65 Explorer in Getting Data In 02-12-2015 0 2	0	2
MultiLine Event- How to Ignore/Drop Specific Events Hi, I have a multi line flat file where I want to ignore/drop specifc events. I'm using the Universial Forwarder, so... by chrisboy68 Contributor in Getting Data In 02-12-2015 0 5	0	5
[RESOLVED] Forwarder stops at midnight on Windows 2012R2 DHCP server log I have Splunk Universal Forwarders on 4 Windows 2012R2 servers, monitoring the DHCP server logs with this stanza: [m... by ww9rivers Contributor in Getting Data In 02-12-2015 0 1	0	1
How to use fields from different source types in the same search? Hi all, I am looking to try and figure out how to compose a query that has information I need in two distinct source... by julianglavey New Member in Getting Data In 02-12-2015 0 2	0	2
Is thawedPath in indexes.conf recommended? Hi Splunkers, I just want to ask if it is required in indexes.conf to specify the thawedPath? Thanks, Eddel by sympatiko Communicator in Getting Data In 02-11-2015 0 5	0	5
Why are new events resulting from mvexpand picking up special characters when exporting to CSV and how to avoid this? This is a strange one, I have a data source which has multiple values in two separate fields so I use the makemv and ... by pjb2160 Path Finder in Getting Data In 02-11-2015 0 1	0	1
Stricter search gives me more results...what? I have a query that looks like this index=ind ((source=src1.log field=NAME) OR (source=src1.log field=STRING)) \|... by rlough Path Finder in Getting Data In 02-11-2015 0 1	0	1
Why is my props.conf configuration not parsing JBoss GC logs properly? Hi guys, I'm trying to parse GC logs from JBoss which look like this: {Heap before GC invocations=1 (full 0): PSY... by rzilist Explorer in Getting Data In 02-11-2015 1 11	1	11
How do I send logs from a SSL VPN device to Splunk Heavy Forwarder? I would like to configure a SSL VPN device to send the logs over to the Splunk Heavy Forwarder on udp/514. How do I ... by galagapp Loves-to-Learn Lots in Getting Data In 02-11-2015 0 2	0	2
Why does Splunk sometimes insert the a blank line in forwarded log4net logs? I have the following log punch by log4net DATE : 02-10-2015 05:06:37 URL : http://localhost/229/processType... by rajeevmcaiomedi New Member in Getting Data In 02-11-2015 0 2	0	2
Events being cut when Linecount > 206. How to increase this limit? For a web service call, my event has a linecount=220. But when looking at the response in Splunk, it is cutting the e... by skoelpin SplunkTrust in Getting Data In 02-11-2015 1 2	1	2
Universal Forwarder - Timezone by sourcetype not working? Just starting out with Splunk recently, still using the free version for now. My Splunk head, indexer & deployment se... by alexism New Member in Getting Data In 02-11-2015 0 1	0	1
How to set a correct line breaks in my props.conf The first picture is my original logs The second picture is my logs in the splunk Now,we can see the splunk wrap ... by perlish Communicator in Getting Data In 02-11-2015 0 7	0	7
Why SEDCMD configured in props.conf is working during Data Preview but not during SEARCH? Hello, I have configured a SEDCMD in props.conf to remove a few unwanted lines of logs. During data preview, the SED... by DavidHourani Super Champion in Getting Data In 02-11-2015 0 6	0	6
Can Splunk strptime() work with the date before 1970-01-01 in epoch format? Sometime I have a timestamp like -633945600.000 in my data. I found a previous post where someone said Splunk only su... by luxiaobin Explorer in Getting Data In 02-11-2015 0 8	0	8
UF persistentQueue tcp,UF persistentQueueSize tcp://8088 We have an application that sends it's data to the UF on tcp port 8088. When the indexers are down we want the UF to ... by arjangoos Path Finder in Getting Data In 02-11-2015 0 3	0	3