Getting Data In

Community Activity

Redact syslog using Splunk? What we are trying to do is pipe DLP incident data to Splunk using syslog. However the challenge is that we need to r... by zerolife Explorer in Getting Data In 04-11-2014 0 2	0	2
Wrong originating host when forwarding syslog from indexer to third party? Hi, i have a weird problem with forwarding logs from my apache servers to both spunk and a 3rd party syslog server. ... by petergus New Member in Getting Data In 04-11-2014 0 1	0	1
Reset frozenTimePeriodInSecs How often does Splunk check for aged data and reclaim disk space? I reset the frozenTimePeriodInSecs on an indexer f... by OldManEd Builder in Getting Data In 04-11-2014 0 4	0	4
Indexer Configuration We have 3 new HP Red Hat Servers we need to install with 13 already running. All of them have 8 drives and the new o... by OldManEd Builder in Getting Data In 04-11-2014 0 1	0	1
Windows Failed Login Top Ten count I am trying to get the top 10 Failed Login count by User. The problem is that Windows 2008 uses "Account_Name" and W... by aberdamy Explorer in Getting Data In 04-11-2014 0 6	0	6
Is it possible to check sed performance in props.conf? Is there a way to test the performance of sed scripts running in props.conf? I'm not an expert in regular expressions... by sc0tt Builder in Getting Data In 04-11-2014 0 3	0	3
which format is efficient for splunk indexing : XML or JSON Hi Which is best format to index for the splunk indexer XML or JSON... what is recommendation from SPlunk like which... by nsiva23 Explorer in Getting Data In 04-11-2014 0 1	0	1
Splunk catalina.out for java.lang.OutOfMemoryError: PermGen space on remote VM I am trying to setup Splunk to monitor a remote tomcat instance ( catalina.out ) for messages like permGen Running ou... by kamal2222ahmed Explorer in Getting Data In 04-10-2014 0 6	0	6
bucket retention and frozenTimePeriodInSecs My index has a retention of 6 months with frozenTimePeriodInSecs=15552000. But I still see some events that are olde... by mataharry Communicator in Getting Data In 04-10-2014 1 2	1	2
How to calculate volume of events across various indexes ? All I want to do is create a query that fetches the below result Day Index-name Volume 4/1 abc 5GB 4/2 abc ... by xbbj3nj Path Finder in Getting Data In 04-10-2014 0 4	0	4
Setting a maximum limit on a monitored file We just had an application bug that spewed millions of duplicate messages into a Splunk monitored logfile. This cause... by genemats Engager in Getting Data In 04-10-2014 4 3	4	3
Upgraded Universal Forwarder, log file no longer monitored Hey all, I'm able to successfully monitor a log file on a Windows server (2008 R2) using the Universal Forwarder whi... by gustavomichels Path Finder in Getting Data In 04-10-2014 0 1	0	1
How to index data from a local process I'm using a Splunk forwarder to forward data from an application running on the same Linux box as my forwarder. Ob... by MatMeredith Path Finder in Getting Data In 04-10-2014 0 1	0	1
Fast way to find size of events on disk for a time period Often times, we are tasked with deleting data out of an index to trim it down. Generally, we do this by setting the ... by hajducko Explorer in Getting Data In 04-09-2014 1 5	1	5
Universal Forwarder to monitor Windows Event Logs Hi, This is probably very basic, but I'm not sure where the actual log file sits for Windows Event Logs. Trying to... by bcusick Communicator in Getting Data In 04-09-2014 0 1	0	1
Windows 2008 Server Event Viewer Logs In the Server 2008 Event Viewer there are now a "Microsoft --> Windows" folders nested under the "Applications and Se... by kbecker Communicator in Getting Data In 04-09-2014 2 5	2	5
need props.conf for custom log I have a custom log in the format where each new record has a entry followed by a pipe (\|) example log: < date time... by rileyken Explorer in Getting Data In 04-09-2014 0 2	0	2
Can I specify TimeZone (TZ) by Index? In my props.conf I know I can change: $SPLUNK_HOME/etc/system/local/ and add: [source::xyz123] TZ=US/East... by hagjos43 Contributor in Getting Data In 04-09-2014 0 2	0	2
Reconcile hosts from multiple timezones in splunk? Hey everyone. I'm wondering how this is possible to accomplish - we have windows server farms across numerous timezo... by msarro Builder in Getting Data In 04-08-2014 1 1	1	1
Universal Forwarder block stops all indexing completely Hi All, We have a customer who could not justify the cost of a clustered solution. So they went down the following r... by phoenixdigital Builder in Getting Data In 04-08-2014 0 1	0	1
WinEventLog filters failing :Windows 2003 and splunk 6 SPL-78726 After upgrading my Windows servers 2003 to Splunk 6. I discovered that all my nullQueues filter stopped working, and ... by yannK Splunk Employee in Getting Data In 04-08-2014 3 7	3	7
how do you configure the searchead so it sends summary index data to a summary index defined on distributed indexers? I want to be able to use the search GUI to create summary index searches, but i want the actual resulting summary ind... by tpsplunk Communicator in Getting Data In 04-08-2014 1 4	1	4
Splunk Universal Forwarders attempting to communicate with indexer on wrong network We've installed and are evaluating Splunk Enterprise 6.0 in a Windows environment (desktops are running Windows 7 Pro... by kenniskoldewyn Explorer in Getting Data In 04-08-2014 1 6	1	6
Universal forwarder scripted install Does anyone know if it is possible to automatically add the current_only = [0\|1] attribute in a scripted Universal Fo... by aberdamy Explorer in Getting Data In 04-08-2014 0 3	0	3
Unable to Start Splunk Service on Windows- failed with ERROR ConfObjectManagerDB - Cannot initialize: D:\Program Files\Splunk\etc\apps\ learned\metadata\default.meta: The operation completed successfully." We are able to start splunk services - But getting following error while starting the services in Heavy Forwarder "... by rbal_splunk Splunk Employee in Getting Data In 04-07-2014 0 1	0	1