Getting Data In

Community Activity

Recomended total index/disk size for one indexer Is there a recommended/optimum size of all the indexes that one indexer can handle? I have not analysed this, but in... by chris Motivator in Getting Data In 04-17-2012 1 6	1	6
sourcenames So as far as i can understand, you can define a common sourcename for several sourcetypes I am using the webintellig... by evosplunk Path Finder in Getting Data In 04-17-2012 0 11	0	11
Setting up input for file monitoring If the wireshark text file is simply stored as a rolling text file (i.e. more data is appended to file, and not store... by misteryuku Communicator in Getting Data In 04-17-2012 0 2	0	2
heavy forwarder to route base on _raw values I'm trying to use the heavy forwarder to route data to different indexes based on values in _raw , is this possible ?... by gooza Communicator in Getting Data In 04-16-2012 0 3	0	3
Log File Monitoring for specific string, rotating log file names, server requirements Hello, fairly new to splunk. I have 3 servers that all have text based log files on them. We need to monitor those lo... by bishop609 New Member in Getting Data In 04-16-2012 0 1	0	1
SNMP Indexing, Firstly I am new to Splunk (so aplogies if this is very simple.) Secondly I have a working snmp file being written t... by asand100 New Member in Getting Data In 04-15-2012 0 2	0	2
fschange blacklist I want to monitor entire Disk Drives and blacklist all .log files recursively using fschange. The only way I can see ... by sgarvin55 Splunk Employee in Getting Data In 04-13-2012 2 5	2	5
Next debug steps for Windows file monitor input? I'm trying to monitor files on a Windows server and it isn't working. I've placed a few stanzas like this into etc/d... by gowen Path Finder in Getting Data In 04-13-2012 2 7	2	7
Set Current only for all in WMI.conf? We are a 90% Windows environment. Since we upgraded to 4.3.1, the WMI log format has changed ever so slightly. While ... by I-Man Communicator in Getting Data In 04-13-2012 0 1	0	1
rewrite _raw from universal forwarder not working... I have the following stansas deployed to lightweight forwarders running Windows: props.conf [WinEventLog:Security] ... by jeff Contributor in Getting Data In 04-13-2012 0 6	0	6
How can one get the host and source IP addresses in the event logs instead of hostname ? Hi, How can one get the host and source IP addresses in the event logs instead of hostname in either places. It is c... by sahil_singh Explorer in Getting Data In 04-13-2012 0 7	0	7
Creating index centrally Hi, Is there any way of creating indexes on several indexers centrally? For a fairly small indexer-farm, it isn't mu... by echalex Builder in Getting Data In 04-12-2012 0 2	0	2
universalfowarder syslog receive and send hi universalforwarder receives and send the syslog data to do? If possible, how do? by khyoung7410 Communicator in Getting Data In 04-12-2012 0 2	0	2
Looping through a Macro using a csv lookup? I have a request from a user who wants to get some stats from the Exchange App around specific users. Namely they're... by Brian_Osburn Builder in Getting Data In 04-12-2012 3 2	3	2
how to sett forwarers to index on path and file name Is it possible to set up forwarders to index data on the path of the file and a portion of the file name automaticall... by jbirchall1 New Member in Getting Data In 04-12-2012 0 2	0	2
Does maxVolumeDataSizeMB in indexes.conf do anything? As far as I can tell, setting maxVolumeDataSizeMB does not trigger bucket moves and has no impact at all. Does anyone... by eugenekogan Explorer in Getting Data In 04-12-2012 0 6	0	6
Error installing any app When I try to install any app from the zipped file, I get an error like: There was an error processing the upload. L... by tchristian New Member in Getting Data In 04-12-2012 0 3	0	3
Props/transforms rewrite of _raw is adding a blank event Hi, I am using a props/transforms TRANSFORM to add the source (log file) name to the _raw log event line. props.con... by Glenn Builder in Getting Data In 04-12-2012 0 1	0	1
Charset Encoding Hi guys, I have installed Splunk 4.3 on a MAC OSX 10.7. I am trying to index data with non utf encoding. I have tri... by kenchisho Path Finder in Getting Data In 04-12-2012 0 3	0	3
Choosing the correct timestamp Hi, I'm having a weird problem with recognizing timestamps. The actual timestamp looks like this: [2012-04-11 11:24:... by echalex Builder in Getting Data In 04-12-2012 0 4	0	4
Can I run multiple Universal Forwarders on Windows Server 2008? I have a Universal Forwarder looking at a directory holding our proxy logs. New logs are dumped into the directory e... by wbfoxii Communicator in Getting Data In 04-12-2012 1 3	1	3
universal forwarder please I need help , I deployed a universal forward by following tutorial "distributed deployement manual" The un... by sarah89 Path Finder in Getting Data In 04-12-2012 1 16	1	16
Filtering and sending only specific data Hi again, I got one question in filtering and routing to indexer. i got my props like this: pros.conf [WinEven... by JPValadas Explorer in Getting Data In 04-12-2012 0 9	0	9
Segregation of incoming data In our environment (mid-size enterprise with remote sites) we have our primary indexer on dedicated hardware. All dat... by sconnors Engager in Getting Data In 04-12-2012 0 5	0	5
Indexing content that may contain in-line gzip We need to index content that may contain in-line gzip (or other compression) content. We do not need to search on th... by johnamcafee New Member in Getting Data In 04-11-2012 0 1	0	1