Getting Data In

Thread Info

Events not being filtered from Universal forwarder

Trying to figure out whey I have events showing up that I am not wanting. I only want the events listed below so tryi...

by Explorer in

Calculating time difference between two fields of the same name in two sourcetypes

All, I have two logs with sourcetype="alphalog" and sourcetype="betalog" with the generic timestamp _time present....

by Builder in

Accessing search results from html file of custom module

My requirement is to create a custom module which will run a search query and pass on the results to a .swf file whic...

by Communicator in

Timestamp extraction props.conf

Hello, We have the following timestamp in our log but are unsure how to edit the props.conf to pick it up: The...

by Splunk Employee in

Splunk universal forwarders

Where does Splunk universal forwarder actually get the data? How do it organizes the data and send to Splunk indexer?...

by Contributor in

CheckPoint FW Logs from Manager with Two Timestamps

We are splunking logs from our CheckPoint FW. The logs are delivered from the CheckPoint manager stations, not direct...

by Communicator in

How to query a universal forwarder about the transfer status of monitored files?

We are monitoring many files with the UF using the [monitor] stanza. For housekeeping reasons we need to delete the f...

by Path Finder in

Extract fields from hardware sourcetype in unix app

So the output of hardware.sh (from the Unix app) is something like this: KEY VALUE CPU_TYPE ...

by Path Finder in

How to avoid blowing the license at the first start.

I have 5 GB /day license, and I am setting up plenty of new forwarders with new inputs. When I will turn them on, I e...

by Communicator in

Shutting down splunk Indexers For Upgrade

I am in a situation where I need to migrate my the splunk indexes to a bigger drive. I was wondering what would be a ...

by Path Finder in

Manager » Data inputs » Files & directories » /var/log >> Blacklist

Hi guys, I try to setup a prevention filter so that Spunk isn't collection data by accident on the Server side. I ...

by New Member in

how often does the forwarder send data to indexer

We are forwarding logs and the question has come up as to how often the forwarder sends data and is there a way to fl...

by Explorer in

Ignoring Comments in Log Files

I am trying to index the httperr files from IIS, located in C:\windows\system32\LogFiles\HTTPERR but each of those fi...

by Explorer in

Calculate total for each source IP and append their floor to a search

Hi, I'm trying to get my Firewall logs to combine the total number of traffic generated by specific IP addresses a...

by Path Finder in

Splunk seems to be ignoring TIME_FORMAT setting

I have an event in CSV format like this: 1/11/2012 3:23 PM,0,1,1 These dates are in the date format common to A...

by Path Finder in

Getting data splunked arriving over a network/database

Here are some specific queries/problem statement I have : How can data be directly fed into splunk in a programmat...

by Engager in

Excessive Sources and Index Latency

First my environment consists of an aggregation server which essentially is a syslog that writes to file, a universal...

by Communicator in

How to restrict or prevent access to certain REST endpoints?

How can I restrict access to specific REST API endpoints?

by Champion in

Splunk not indexing data if time contains a colon

I've having an odd issue with Splunk. I'm attempting a scripted input that outputs current users logged into an oracl...

by Engager in

GZIPPED files are being reindexed

Hello, I'm aware of an issue with GZ files that get written to causing the entire file to be reindexed. On a ...

by Path Finder in

How can I get the max volume per day for the license stack used using the REST API

Hello, I can get information about the license stacks via the CLI: splunk list licenser-stacks I would like to get...

by Explorer in

netflow missing fields problem with flowIntegrator

Hi all, I managed to retrieve netflow from my cisco firewall by using flowIntegrator and splunk. But the problem ...

by Engager in

Palo Alto's Netflow data not showing up in Splunk 5.0.1 via Netflow Integrator 3.1

I have a Palo Alto server running PANOS 5.0.1 that is sending netflow data to Netflow Integrator 3.1 on Splunk 5.0.1....

by New Member in

xpath with splunk

How compliant is the xpath command with the real xpath? Is there a specific xpath library used?

by Communicator in

Splunk for Microsoft Exchange : deployment question

Hello, my question is quite simple : is that possible to use Splunk for Microsoft Exchange application only splunk...

by Path Finder in

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Getting Data In

Discussions

Events not being filtered from Universal forwarder

Calculating time difference between two fields of the same name in two sourcetypes

Accessing search results from html file of custom module

Timestamp extraction props.conf

Splunk universal forwarders

CheckPoint FW Logs from Manager with Two Timestamps

How to query a universal forwarder about the transfer status of monitored files?

Extract fields from hardware sourcetype in unix app

How to avoid blowing the license at the first start.

Shutting down splunk Indexers For Upgrade

Manager » Data inputs » Files & directories » /var/log >> Blacklist

how often does the forwarder send data to indexer

Ignoring Comments in Log Files

Calculate total for each source IP and append their floor to a search

Splunk seems to be ignoring TIME_FORMAT setting

Getting data splunked arriving over a network/database

Excessive Sources and Index Latency

How to restrict or prevent access to certain REST endpoints?

Splunk not indexing data if time contains a colon

GZIPPED files are being reindexed

How can I get the max volume per day for the license stack used using the REST API

netflow missing fields problem with flowIntegrator

Palo Alto's Netflow data not showing up in Splunk 5.0.1 via Netflow Integrator 3.1

xpath with splunk

Splunk for Microsoft Exchange : deployment question

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

Splunk Answers Content Calendar, July Edition I

Splunk Answers Content Calendar May 2025 🎉

Solaris UFs have different build hash than others

Edge Processor Destination not showing up in Pipel...

ERROR: Tor IP are not updating in lookup

How to integrate SentinelOne Singularity Enterpris...

Getting Data In

Are you a member of the Splunk Community?

Discussions