Getting Data In

Community Activity

nullqueue or nullQueue ? I saw this in transforms.conf : should if be nullQueue or nullqueue ? [send_to_nullqueue] DEST_KEY = queue REGEX ... by yannK Splunk Employee in Getting Data In 10-10-2012 2 2	2	2
ArchiveProcessor - Bypassing normal system/local/props.conf processing for .dat files inside archives? (4.3.4) I have a situation in which it would seem that for .dat files inside an archive I can not make it honor the settings ... by Lucas_K Motivator in Getting Data In 10-09-2012 0 1	0	1
Correct TIME_FORMAT for the following timestamp? Hello, I'm having trouble extracting the following timestamp for one source, is there someone here that can recommend... by infomedix New Member in Getting Data In 10-09-2012 0 5	0	5
Best way to change the inputs.conf file of a universal forwarder from deployment server. Can any one please let me know the best way to update the opt/splunkforwarder/etc/system/local/inputs.conf of univers... by ssankeneni Communicator in Getting Data In 10-09-2012 0 5	0	5
importing all the files available in a directory Hi, Can any body tell me how to import all the files of a particular directory in splunk at one go ? next time if I ... by abhayneilam Contributor in Getting Data In 10-09-2012 0 16	0	16
Have forwarder duplicating data to 2 indexes. For some inputs on a forwarder, I want to send the same data to the same indexer, but duplicate it in 2 indexes (they... by mataharry Communicator in Getting Data In 10-09-2012 1 2	1	2
Data is not making to indexer The Data forwarded by universal forwarder is not making to the indexer. There is no clue on splunkd.log file even. It... by ssankeneni Communicator in Getting Data In 10-09-2012 0 4	0	4
WinEventLog information from WMI isn't making it to the indexer. All of my .conf files are setup correctly yet I still can't get any WinEventLog information via WMI into my indexer. ... by DerekB Splunk Employee in Getting Data In 10-09-2012 4 1	4	1
What is the correct syntax to have fschange search multiple directories? Will the following work: [fschange:C:\Program Files\progam\|D:\File\group] Should replace "\|" with "OR",or should i ... by nick085 Engager in Getting Data In 10-09-2012 1 1	1	1
Transmission of historical "store-and-forward" data after target indexer failure Hi All, I am currently designing a deployment with two Splunk "pods" in different data centres, each with two Indexe... by rturk Builder in Getting Data In 10-09-2012 0 2	0	2
where are source type names created? I'm wondering if there are other locations than inputs.conf, props.conf that a sourcetype might be named/assigned. I ... by ryan461 Explorer in Getting Data In 10-09-2012 0 5	0	5
How to index locally all incoming data and forward all input data in heavy forwarder Hello, I have one heavy forwarder that receives data from some forwarders. After that, it indexes all those data, bu... by sieutruc Contributor in Getting Data In 10-09-2012 0 4	0	4
Indexing Throttling A network socket process went bug-eyed today creating more than 7 million /var/log/messages events in 15min. The ind... by Edub Explorer in Getting Data In 10-09-2012 5 3	5	3
Execute a script on the node itself We have a splitted environment where we are using another tool to take care of typical monitoring like cpu, disk, mem... by lsolberg Path Finder in Getting Data In 10-09-2012 0 4	0	4
how to index mutiple files i am importing data into splunk by using Continuously index data from a file or directory this Splunk instance can a... by Tridi123 New Member in Getting Data In 10-08-2012 0 1	0	1
CSV TImestamp Problem Hello Folks, I have a csv file which has timestamp divided among various fields. (Initial 4 columns are shown) year,... by mehal New Member in Getting Data In 10-08-2012 0 4	0	4
Not able to find REST endpoint for MySQL App to search the database Hello, I have been using REST for basic searching and getting results from saved searches from splunk via splunk SDK... by vickypandya Engager in Getting Data In 10-08-2012 1 1	1	1
List of sourcetypes with no data for past 7 days I have a bunch of logs from a program that regularly updates local files with changes in network files, and I would l... by atreece Path Finder in Getting Data In 10-08-2012 0 3	0	3
Simple field extractions not working in props We are having an issue getting fields to work with this one application. If we move the props.conf to the etc/system... by brantramey Explorer in Getting Data In 10-08-2012 0 2	0	2
gentoo unversal forwarder? Which version of the universal forwarder - http://www.splunk.com/download/universalforwarder - do I use for Gentoo? I... by bauer_devop New Member in Getting Data In 10-08-2012 0 1	0	1
Best 'monitor' setup for firewall logs Hey guys, Noob here; I wanted to know what you thought would be the best setup to use the monitor function in inputs... by SplunkUser5888 Path Finder in Getting Data In 10-08-2012 0 3	0	3
linebreaking question - props.conf change at searchhead, forwarder or indexer? I want to correct the linebreaking for my secure.txt file. Do I need to configure props.conf at the searchhead, inde... by edchow Explorer in Getting Data In 10-07-2012 1 1	1	1
Scripted Input timeout Hypothetically, if I have a scripted input that takes 6 minutes to run, and I execute it every 5 minutes, what should... by paulathome Path Finder in Getting Data In 10-07-2012 0 3	0	3
Syslog from Cisco ASA directly into SPLUNK on Ubuntu 12.04 64bit Server Hi all Let me preface this with. I am new to SPLUNK - I installed it 2 hours ago & I think it's great. I have tried... by jsmander Explorer in Getting Data In 10-06-2012 3 5	3	5
Scripted inputs fails on pooled search heads I am trying to implement the Cisco IPS App on pooled search heads, but the scripted inputs are failing with the follo... by richnavis Contributor in Getting Data In 10-06-2012 1 3	1	3