Getting Data In
Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
Options
- Mark all as New
- Mark all as Read
- Float this item to the top
- Subscribe
- Bookmark
- Subscribe to RSS Feed
- Threaded format
- Linear Format
- Sort by Topic Start Date
Discussions
| Thread Info | |||||
|---|---|---|---|---|---|
|
I'm trying to use the heavy forwarder to route data to different indexes based on values in _raw , is this possible ?...
by
gooza
Communicator
in
Getting Data In
02-23-2012
|
0
|
3
| ||
|
|
Hello, fairly new to splunk. I have 3 servers that all have text based log files on them. We need to monitor those lo...
by
bishop609
New Member
in
Getting Data In
04-16-2012
|
0
|
1
| ||
|
|
Firstly I am new to Splunk (so aplogies if this is very simple.)
Secondly I have a working snmp file being written...
by
asand100
New Member
in
Getting Data In
04-15-2012
|
0
|
2
| ||
|
|
I want to monitor entire Disk Drives and blacklist all .log files recursively using fschange. The only way I can see ...
by
sgarvin55
Splunk Employee
in
Getting Data In
04-13-2012
|
2
|
5
| ||
|
|
I'm trying to monitor files on a Windows server and it isn't working. I've placed a few stanzas like this into etc/de...
by
gowen
Path Finder
in
Getting Data In
04-11-2012
|
2
|
7
| ||
|
|
We are a 90% Windows environment. Since we upgraded to 4.3.1, the WMI log format has changed ever so slightly. While ...
by
I-Man
Communicator
in
Getting Data In
04-13-2012
|
0
|
1
| ||
|
I have the following stansas deployed to lightweight forwarders running Windows:
props.conf
[WinEventLog:Securi...
by
jeff
Contributor
in
Getting Data In
04-12-2012
|
0
|
6
| ||
|
|
Hi,
How can one get the host and source IP addresses in the event logs instead of hostname in either places. It is...
by
sahil_singh
Explorer
in
Getting Data In
04-09-2012
|
0
|
7
| ||
|
|
Hi,
Is there any way of creating indexes on several indexers centrally? For a fairly small indexer-farm, it isn't ...
by
echalex
Builder
in
Getting Data In
04-12-2012
|
0
|
2
| ||
|
|
hi universalforwarder receives and send the syslog data to do? If possible, how do?
by
khyoung7410
Communicator
in
Getting Data In
04-12-2012
|
0
|
2
| ||
|
|
I have a request from a user who wants to get some stats from the Exchange App around specific users. Namely they're ...
by
Brian_Osburn
Builder
in
Getting Data In
04-12-2012
|
3
|
2
| ||
|
|
Is it possible to set up forwarders to index data on the path of the file and a portion of the file name automaticall...
by
jbirchall1
New Member
in
Getting Data In
04-12-2012
|
0
|
2
| ||
|
|
As far as I can tell, setting maxVolumeDataSizeMB does not trigger bucket moves and has no impact at all. Does anyone...
by
eugenekogan
Explorer
in
Getting Data In
04-11-2012
|
0
|
6
| ||
|
|
When I try to install any app from the zipped file, I get an error like: There was an error processing the upload.
...
by
tchristian
New Member
in
Getting Data In
03-16-2012
|
0
|
3
| ||
|
|
Hi,
I am using a props/transforms TRANSFORM to add the source (log file) name to the _raw log event line.
props...
by
Glenn
Builder
in
Getting Data In
02-17-2012
|
0
|
1
| ||
|
|
Hi guys,
I have installed Splunk 4.3 on a MAC OSX 10.7.
I am trying to index data with non utf encoding. I have...
by
kenchisho
Path Finder
in
Getting Data In
04-12-2012
|
0
|
3
| ||
|
|
Hi, I'm having a weird problem with recognizing timestamps. The actual timestamp looks like this:
[2012-04-11 11:2...
by
echalex
Builder
in
Getting Data In
04-11-2012
|
0
|
4
| ||
|
I have a Universal Forwarder looking at a directory holding our proxy logs. New logs are dumped into the directory ev...
by
wbfoxii
Communicator
in
Getting Data In
03-16-2012
|
1
|
3
| ||
|
|
please I need help ,
I deployed a universal forward by following tutorial "distributed deployement manual"
Th...
by
sarah89
Path Finder
in
Getting Data In
04-05-2012
|
1
|
16
| ||
|
|
Hi again,
I got one question in filtering and routing to indexer.
i got my props like this:
pros.conf
...
by
JPValadas
Explorer
in
Getting Data In
04-11-2012
|
0
|
9
| ||
|
In our environment (mid-size enterprise with remote sites) we have our primary indexer on dedicated hardware. All dat...
by
sconnors
Engager
in
Getting Data In
04-11-2012
|
0
|
5
| ||
|
|
We need to index content that may contain in-line gzip (or other compression) content. We do not need to search on th...
by
johnamcafee
New Member
in
Getting Data In
04-11-2012
|
0
|
1
| ||
|
|
I wanted to see how Splunk would index my data, so I configured it to index a few files into a 'test' index. Now that...
by
Mick
Splunk Employee
in
Getting Data In
04-09-2010
|
3
|
6
| ||
|
|
I'm looking at a Splunk instance right now that is getting 99+% of its data as one particular sourcetype, from two he...
by
Jason
Motivator
in
Getting Data In
04-11-2012
|
1
|
5
| ||
|
Hi I have a license pool for X Gb per day, and I blow it every almost every single day. How to selectively reduce my...
by
mataharry
Communicator
in
Getting Data In
01-31-2012
|
1
|
3
|
Get Started
Explore Essential Splunk Resources
Get Expert Help at Community Office Hours
Join the #getting-data-in Slack channel
Get Expert Help at Community Office Hours
Join the #getting-data-in Slack channel
Become An Expert
Top Labels
-
add-on
2 -
administration
11 -
AIX
1 -
audit
1 -
blacklist
90 -
CLI
1 -
configuration
29 -
CSV
202 -
data
424 -
development
5 -
encryption
1 -
eval
2 -
field extraction
531 -
fields
4 -
forwarder
1 -
forwarder management
3 -
heavy
1 -
heavy forwarder
885 -
host
151 -
HTTP Event Collector
418 -
index
524 -
indexer
670 -
indexing performance
1 -
inputs.conf
801 -
installation
4 -
intermediate forwarder
132 -
introduction
3 -
JSON
376 -
kvstore
1 -
Linux
427 -
login
1 -
Mac
29 -
metadata
1 -
metrics
2 -
modular input
179 -
monitor
301 -
monitoring console
1 -
other
15 -
proactive Splunk component monitoring
2 -
props.conf
926 -
regex
5 -
saved search
2 -
scripted input
237 -
search
1 -
search head
2 -
source
279 -
sourcetype
469 -
Splunk Enterprise
1 -
Splunk Investigate
1 -
splunk-assist
2 -
subsearch
1 -
syslog
298 -
time
202 -
transforms.conf
547 -
troubleshooting
15 -
universal forwarder
1,497 -
using Enterprise Security
3 -
using Splunk Cloud
4 -
using Splunk Enterprise
14 -
whitelist
60 -
Windows
566 -
XML
89
- « Previous « Previous
- Next » Next »
Get Updates on the Splunk Community!
.conf25 Registration is OPEN!
Ready. Set. Splunk!
Your favorite Splunk user event is back and better than ever. Get ready for more technical ...
Detecting Cross-Channel Fraud with Splunk
This article is the final installment in our three-part series exploring fraud detection techniques using ...
Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside
Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...
