Getting Data In

Community Activity

Can we Split the results based on the users and email them ? Hi.. I am trying to find the custom script which emails the conents of the search results specific to the users. I h... by rakesh_498115 Motivator in Getting Data In 11-07-2013 0 2	0	2
Universal forwarder, can a Splunk 5.0.5 forwarder forward to Splunk 6.0 indexer Universal forwarder, can a Splunk 5.0.5 forwarder forward to Splunk 6.0 indexer? by somesoni2 Revered Legend in Getting Data In 11-07-2013 0 1	0	1
Search head pooling with DNS round robin - getting logged out almost immediately after logging in? Greetings everyone. We have a moderately sized distributed deployment. We have 3 search heads pooled, and all 3 have ... by msarro Builder in Getting Data In 11-07-2013 0 5	0	5
Mean for Failed Logons to Windows I'm trying to grab the number value of all failed logons on windows logs (eventually will be failed logons per accoun... by hagjos43 Contributor in Getting Data In 11-07-2013 0 5	0	5
splunk forwarders using too many sockets I have the following config in outputs.conf for splunk forwarder installed on a linux machine. connectionTimeout = 2... by dtekas New Member in Getting Data In 11-07-2013 0 2	0	2
Blacklist pattern for distsearch.conf Does anyone have any examples of regex used in the Blacklist patterns for distsearch.conf? We are trying to limit wha... by ride76 Explorer in Getting Data In 11-06-2013 1 1	1	1
Limiting file input I have a SOAP output file that I want to do metrics on in Splunk. There is a lot of data in the envelope that is usel... by Lazarix Communicator in Getting Data In 11-06-2013 0 8	0	8
Changing inputs.conf to include previously scanned files When initially set up my splunk install is set to capture only the most recent version of a log: /path/to/log/dir/lo... by tyronetv Communicator in Getting Data In 11-06-2013 0 1	0	1
How to delete an "source type" that is tied to indexed data. I accidentally added the source type and now want to correct it. Can help? Hi, still learning Splunk and.....need to know.. How to delete an "source type" that is tied to indexed data. I accid... by nitin82pandey New Member in Getting Data In 11-06-2013 0 5	0	5
Forward data input copy to syslog without apply SEDCMD I collect my data using UniveralForwarder, them send it to HeavyForwarder. I would like to send a copy of data that ... by fabiocaldas Contributor in Getting Data In 11-05-2013 0 1	0	1
Order of operations? SEDCMD vs TRANSFORMS In the indexing process, which happens first the SEDCMD-* entries or TRANSFORMS-* entries? by Lowell Super Champion in Getting Data In 11-05-2013 3 2	3	2
How to configure a 4.1.2 forwarder to auto load balance across indexers I'm trying to figure out how to configure the forwarders to auto load balance. I saw this: http://www.splunk.com/bas... by msvoboda New Member in Getting Data In 11-04-2013 0 3	0	3
At what point do very large lookup files (csv) get indexed? After creating a very large lookup csv file splunk creates *.csv.index directories under my lookup directory. What is... by rroberts Splunk Employee in Getting Data In 11-04-2013 1 2	1	2
How to filter or extract fields before indexing time I have got very large orginal data, with events strictly formatted as "f1,f2,f3,..." most of the fields are meaningle... by crazyeva Contributor in Getting Data In 11-04-2013 0 4	0	4
Asian language support Does Splunk have problem showing Language data from Windows server? It's Korean data that we are indexing, but after... by clyde772 Communicator in Getting Data In 11-03-2013 0 2	0	2
replicationBlacklist example? I'm trying to configure replicationBlacklist but see no regex examples that are beyond a basic *.filetype: [replicat... by the_wolverine Champion in Getting Data In 11-02-2013 0 1	0	1
Filtering/nullQueue Question I’m trying to get our AIX data into Splunk, but I’m having a filter/nullQueue issue. I was wanting to keep certain e... by kmcconnell Path Finder in Getting Data In 11-01-2013 0 4	0	4
Setting up an ultra-light front-end instance for API request Hello. In our company we already have a Splunk 5 setup with multiple search heads and indexers. What I would like t... by sgerogia New Member in Getting Data In 11-01-2013 0 3	0	3
fschange with \...\ This is my inputs.conf [fschange://C:\Users...\AppData\Local\Microsoft\Windows\Burn] index=windows recurse=true sour... by mcbradford Contributor in Getting Data In 11-01-2013 0 2	0	2
Linux Syslogd Config This is not a splunk specific question however it is very related and involves config of syslog on a linux host that ... by balcv Contributor in Getting Data In 11-01-2013 0 7	0	7
Forwarders reporting in, but no log data being sent I have two nix servers that are failing to send log data over. If I search index=_internal I can see the forwarders a... by hagjos43 Contributor in Getting Data In 11-01-2013 0 4	0	4
Keep Last Daily Activity Per User Hi, i would like to keep the last event/activity of a day for every user (so filter out all other events). I used ... by HeinzWaescher Motivator in Getting Data In 11-01-2013 0 8	0	8
Sourcetype="something" returns no results I have a very simple scripted input which calls a .cmd file and in turn calls a .ps1 file. That PS1 file does a test-... by O2Anthony New Member in Getting Data In 11-01-2013 0 3	0	3
SyntaxError: JSON.parse: unexpected character in splunk I am facing the following error when loading data to splunk. "Your entry was not saved. The following error was repo... by kavyatim Path Finder in Getting Data In 11-01-2013 1 1	1	1
Editing an existing data input creates new item When I try to edit an existing data input, it's creating a new one. Shouldn't it just update it? by adrianp Path Finder in Getting Data In 11-01-2013 1 4	1	4