Getting Data In

Community Activity

Monitoring Windows local administrator group Hi, I want to monitor membership of the Local Administrators group on several of my systems. When I run the WMI qu... by cyrus494 Engager in Getting Data In 10-29-2013 0 1	0	1
Exclude tar files in inputs.conf Hello, Is there a way to "blacklist" or exclude tar.gz file with in a monitored directory in the inputs.conf file.... by tevgey23 Explorer in Getting Data In 10-29-2013 0 4	0	4
Quote delimited fields containing spaces In the past our iis logs were space delimited with the user agent field using the plus sign as an internal delimiter,... by kmattern Builder in Getting Data In 10-29-2013 0 1	0	1
Deployment Monitor Missing Forwarders The Missing Forwarders dashboard is telling me that there are x number of missing forwarders which "have not connecte... by jdunlea_splunk Splunk Employee in Getting Data In 10-29-2013 3 1	3	1
Why WinEventLog collection on busy domain controllers were slow before, and are now fast on Splunk 6.0 In splunk 4.* and 5.* I used to have Splunk Universal forwarders on Windows Domain Controllers. The volume of events... by mataharry Communicator in Getting Data In 10-29-2013 3 1	3	1
Problems Deleting Data in Splunk 6 Trying to delete data from an index for a specific day, and keep getting an error. index=os sourcetype=ps provides 6... by conner9 Path Finder in Getting Data In 10-29-2013 1 3	1	3
Failed to parse timestamp on Heavy Forwarder I have an App that is indexing data on a Heavy forwarder. The text file has a mix of headers and data, the data cont... by richnavis Contributor in Getting Data In 10-29-2013 0 6	0	6
Unable to get logging events from Citrix deployment servers We recently installed Splunk app for Citrix, but only windows: security sourcetypes are generating events , citrix re... by OMohi Path Finder in Getting Data In 10-28-2013 0 1	0	1
Forwarding to syslog stream Hi, I've configured Splunk to forward data to a third party system we use. I can see on the packet captures that th... by MHibbin Influencer in Getting Data In 10-28-2013 0 2	0	2
Filtering on Both EventCode and Logon Type for Forwarder Hi All, I'm presently forwarding a number of different events to a receiver. It's working fine for complete events,... by Scarecrowddb Explorer in Getting Data In 10-25-2013 1 3	1	3
WinEventLog filtering EventCode I have a Splunk central indexer on rhel5.5 and a forwarder (not LWF) on a Server 2008 VM. Currently I am forwarding a... by joshrabinowitz Path Finder in Getting Data In 10-25-2013 0 3	0	3
How do I convert serial date time? How do I convert serial date time (1900 Date System)? For example, I would like to convert 41215.10417 to 11/2/12 2... by ckumbier New Member in Getting Data In 10-25-2013 0 4	0	4
Why is some data still present in index long after exceeding frozen time period I currently have two indexes, frozenTimePeriodInSecs=432000, and respective frozen directories outside the Splunk dir... by andrewfoglesong Explorer in Getting Data In 10-25-2013 0 3	0	3
Powershell in Splunk Hi I am new to the splunk. I have powershell script which we used to collect data and send email. Now i need to impl... by rsathish47 Contributor in Getting Data In 10-25-2013 0 3	0	3
Create new customer access-extractions We use a custom access log format which, as far as I can tell, matches the access-extractions except has a preceding ... by sloshburch Ultra Champion in Getting Data In 10-25-2013 0 4	0	4
Convert sourcetype I've got a file that was previously indexed as sourcetype1 but I want it to be customer_sourcetype2. I thought there... by sloshburch Ultra Champion in Getting Data In 10-25-2013 0 6	0	6
Extract field values Hi, I have having the following stanza in transforms.conf [apache_fields] DELIMS = "\t" FIELDS = clientip,remotelogn... by shangshin Builder in Getting Data In 10-25-2013 0 4	0	4
Extracting Timestamp from a txt file Hi all, I know that there are several post on this question before, but I can't seem to figure out the correct answe... by TimothyPeh Engager in Getting Data In 10-25-2013 0 3	0	3
Determine Index Retention Time Hello, We have about 10 indexers setup in our distributed search. Not sure if this matters. where do I go to dete... by daniel333 Builder in Getting Data In 10-24-2013 0 2	0	2
Rolling restart of Cluster puts peer in restart loop Hi All, After fresh installs of Splunk (Windows v5.0.4) I had (had) a fully functioning cluster that was happily rep... by rturk Builder in Getting Data In 10-24-2013 1 1	1	1
Configure forwarder to select indexer based on network availibility Our network has 4 "zones". In general, servers in each zone can only talk to other servers in the same zone as them. ... by rtadams89 Contributor in Getting Data In 10-24-2013 1 3	1	3
Getting date and time from CSV Hi, This is on Splunk 5 and I have a csv file sample header as foo,foo2,foo3,foo4,foo5,foo6 The date is on foo3 as 1... by psow_splunk Splunk Employee in Getting Data In 10-24-2013 0 1	0	1
spoof source IP when sending syslog to 3rd party syslog server Hi all, As described in the title, I need to forward syslog event log to other server. However, I am getting the same... by hswoo2000 Explorer in Getting Data In 10-23-2013 1 2	1	2
No output from modular input_ta I cant seem to get my modular input to write anything when I package, import, and run it. I have created a scripted i... by kkentsplunk Engager in Getting Data In 10-23-2013 0 2	0	2
Split JSON object attributes out as key-value I have a JSON object of currency conversion rates as the event, which looks like { "base": "USD", "rates": { ... by johnoxley_liqui Engager in Getting Data In 10-23-2013 1 1	1	1