Getting Data In

Community Activity

Handshake and socket error OS for forwarder: Windows Server 2012 Splunk + Universal Forwarder version: 6 I'm trying to get my Universal Forward... by drberg Explorer in Getting Data In 11-11-2013 0 3	0	3
Splunkd is not running after executing add monitor command Hi, I installed splunk on Ubuntu 12.04 64-bit in GoGrid. I have 8 clusters (1 master, 1 search node, 3 indexers, 3 ... by sravan2j Explorer in Getting Data In 11-10-2013 0 6	0	6
Splunk not indexing new hosts I've added new servers that are pushing their syslogs to my splunk host. The messages are getting properly routed to ... by ptierney New Member in Getting Data In 11-10-2013 0 6	0	6
Inputs.conf and Multiple sourcetypes Is it possible to monitor a directory for files that will be input with different source types (assuming I'd use whit... by andrewkenth Communicator in Getting Data In 11-10-2013 1 2	1	2
Unable to initialize modular input Hi, I'm new to splunk. I'm getting this error "Unable to initialize modular input "LTA" defined inside the app "LTATe... by hikari992 Explorer in Getting Data In 11-10-2013 3 4	3	4
Splunk 6 query format for JSON data We send JSON formatted data into Splunk. On upgrading to Splunk 6 I noticed that selecting the value of a JSON field ... by amanteja Path Finder in Getting Data In 11-09-2013 0 1	0	1
ASA 8.1,8.2 sample logs Can someone help me out to get some sample ASA 8.1 & 8.2 log messages. by eldhose Engager in Getting Data In 11-08-2013 1 1	1	1
Syslog data inputs not creating new sources I used to have 2 UDP syslog data inputs: UDP://514 going to the default index, UDP://515 going to a new index. They w... by lmarcel New Member in Getting Data In 11-08-2013 0 3	0	3
How do I apply a new linemerge rule to historical data? I'm trying to add a new linemerge rule to my props.conf. I'm currently putting it in etc/system/local/props.conf but ... by stevennoble Explorer in Getting Data In 11-08-2013 0 1	0	1
Time prefix ; I have events that end and start with : orderLock;null; 2013-11-07 05:55:38.431; Log entry...... 162405913;; 2013-11... by smudge797 Path Finder in Getting Data In 11-08-2013 0 6	0	6
How to forward all logs in Event Viewer? I guess the title says it all. In general I want to know if there's any way of sending all Windows Event logs throug... by drberg Explorer in Getting Data In 11-08-2013 0 2	0	2
why lookup with outputnew doesn't work, when configured in props.conf Hi, I have a search with two lookups ... \| lookup user_agent_filter OUTPUT botstatus \| lookup ipnet_filter cidr AS... by marcokrueger Path Finder in Getting Data In 11-07-2013 0 2	0	2
UDP data on 516 port on a universal forwarder not showing up on splunk indexer Hi All, I have a splunk Indexer receiving data from Kiwi syslog installed on a Splunk Forwarder machine. it also rec... by rawatvineet Engager in Getting Data In 11-07-2013 0 15	0	15
Splunk for Cisco Network Devices Hi All We currently have splunk installed, and have a fleet of cisco devices feeding syslog to it. This includes: Da... by CeJay Explorer in Getting Data In 11-07-2013 0 10	0	10
How to detect that a file has been indexed I have an automated process running on a Windows server that has the Universal Forwarder installed. It drops files fo... by JeremyHagan Communicator in Getting Data In 11-07-2013 0 4	0	4
Problem forwarding Advanced IIS Logs I am experiencing an issue where my universal forwarder (v5.0.4) is not forwarding my IIS Advanced Logs to the indexe... by DaClyde Contributor in Getting Data In 11-07-2013 1 15	1	15
Event time confusion I'm having a hard time setting up forwarding and event times. Here's my situation. I have an application that creat... by OldManEd Builder in Getting Data In 11-07-2013 0 13	0	13
Same sourcetype, but different transforms per Host I have an issue where we have a sourcetype that we want to remove a transform (on the indexer) that drops some data (... by adylent Path Finder in Getting Data In 11-07-2013 0 2	0	2
Only one syslog shows up on server I have a new windows install and I can only get one syslog to show up. Any other devices I direct to send their logs... by slacknetter New Member in Getting Data In 11-07-2013 0 6	0	6
Can we Split the results based on the users and email them ? Hi.. I am trying to find the custom script which emails the conents of the search results specific to the users. I h... by rakesh_498115 Motivator in Getting Data In 11-07-2013 0 2	0	2
Universal forwarder, can a Splunk 5.0.5 forwarder forward to Splunk 6.0 indexer Universal forwarder, can a Splunk 5.0.5 forwarder forward to Splunk 6.0 indexer? by somesoni2 Revered Legend in Getting Data In 11-07-2013 0 1	0	1
Search head pooling with DNS round robin - getting logged out almost immediately after logging in? Greetings everyone. We have a moderately sized distributed deployment. We have 3 search heads pooled, and all 3 have ... by msarro Builder in Getting Data In 11-07-2013 0 5	0	5
Mean for Failed Logons to Windows I'm trying to grab the number value of all failed logons on windows logs (eventually will be failed logons per accoun... by hagjos43 Contributor in Getting Data In 11-07-2013 0 5	0	5
splunk forwarders using too many sockets I have the following config in outputs.conf for splunk forwarder installed on a linux machine. connectionTimeout = 2... by dtekas New Member in Getting Data In 11-07-2013 0 2	0	2
Blacklist pattern for distsearch.conf Does anyone have any examples of regex used in the Blacklist patterns for distsearch.conf? We are trying to limit wha... by ride76 Explorer in Getting Data In 11-06-2013 1 1	1	1