Splunk Administration

Splunk Administration
Category Activity
zksvc
Hi Everyone,I am in the process of installing Splunk UBA and have a question regarding the storage partitioning requi...
by zksvc Contributor in Deployment Architecture 07-31-2025
0 6
0
6
L_Petch
Hello, I need to send all syslog data from opnsense to a specific index. As this is not a known vender source what is...
by L_Petch Path Finder in Getting Data In 07-31-2025
0 2
0
2
obuobu
Hey, I installed splunk enterprise free trial on ubuntu server and this is the first time I am using splunk so I am f...
by obuobu Engager in Getting Data In 07-30-2025
1 4
1
4
ewok
Running Splunk 9.3.5 on RHEL 8.  STIG hardened environment. The non-Splunk RHEL instances running a Universal Forward...
by ewok Explorer in Getting Data In 07-30-2025
0 4
0
4
Na_Kang_Lim
Hi, as the question suggest, I am trying to send 2 streams of logs.From the document Forward data to third-party syst...
by Na_Kang_Lim Path Finder in Getting Data In 07-30-2025
0 1
0
1
sigma
Hi all,I want to extract fields from a custom log format. Here's my transforms.conf:REGEX = ^\w+\s+\d+\s+\d+:\d+:\d+\...
by sigma Path Finder in Getting Data In 07-29-2025
0 2
0
2
juniormint
I am doing some refactoring of authentication.conf and would like to be able to diff the users and their mapped roles...
by juniormint Communicator in Security 07-29-2025
0 17
0
17
bfrisan
Our Nessus vulnerability scanner is flagging that the server_pkcs1.pem certificate is expired.I have verified that it...
by bfrisan Loves-to-Learn in Security 07-28-2025
0 6
0
6
KwonTaeHoon
HelloI'm collecting cloudtrail logs by installing Splunk add on AWS in the Splunk heavy forwarder.The following logs ...
by KwonTaeHoon Path Finder in Getting Data In 07-28-2025
0 1
0
1
sigma
Hi all,I'm collecting iLO logs in Splunk and have set up configurations on a Heavy Forwarder (HF). Logs are correctly...
by sigma Path Finder in Getting Data In 07-28-2025
0 5
0
5
shoaibalimir
Hi Community,I'm exploring ways to ingest data into Splunk Cloud from a Amazon s3 Bucket which has multiple directori...
by shoaibalimir Path Finder in Getting Data In 07-28-2025
0 2
0
2
stefanlasiewski
I'm installing Splunk on an Enterprise Linux 6.1 machine. The Install on Linux instructions talk about a RPM, but d...
by stefanlasiewski Contributor in Security 07-28-2025
36 65
36
65
n_hoh
Hi All I've been tasked with setting up logging for Windows Certification Services and getting this into Splunk.Have ...
by n_hoh Observer in Getting Data In 07-28-2025
0 6
0
6
verbal_666
Hi.During the day, some on my Indexers completely stops sending back the ACK, so many agents keep data in queue until...
by verbal_666 Builder in Getting Data In 07-26-2025
0 6
0
6
isahu
I onboarded one production logs to splunk but after restarting the UF I am not able to see the recent logs also I am ...
by isahu Observer in Getting Data In 07-26-2025
0 3
0
3
samalchow
I’ve inherited a fleet of about 150 Windows Servers, all configured identically — same Deployment Server, TAs, inputs...
by samalchow Observer in Getting Data In 07-25-2025
0 6
0
6
jbanAtSplunk
Hi,Does anyone have a good example from Logstash to Splunk HEC?I only get "services/collector/raw" working with logst...
by jbanAtSplunk Communicator in Getting Data In 07-24-2025
0 18
0
18
elend
I wanna ask something on my lab clustered indexer. I got max primary capacity on my indexer. Last time i just reduce ...
by elend Communicator in Deployment Architecture 07-24-2025
0 8
0
8
Scottk1
Client is asking about Splunk Cloud backup and recovery procedure for DR. Specifically all the configuration, searche...
by Scottk1 Loves-to-Learn Lots in Monitoring Splunk 07-24-2025
0 2
0
2
zaks191
Hi Splunk Community,I'm new to Splunk and working on a deployment where we index large volumes of data (approximately...
by zaks191 New Member in Getting Data In 07-24-2025
0 5
0
5
sabari80
I have a scheduled export report for daily 11PM from my monitoring dashboard. we are in EST time zone and my dashboar...
by sabari80 Explorer in Knowledge Management 07-23-2025
0 2
0
2
zksvc
Hi Everyone, in default correlation search the name "Excessive Failed Logins" my drilldown cannot define $info_min_ti...
by zksvc Contributor in Deployment Architecture 07-22-2025
3 10
3
10
nopera
Hi,Could you help me retrieve message-tracking logs from our on-premises Exchange server? I added the following lines...
by nopera Explorer in Getting Data In 07-22-2025
0 11
0
11
dsgoody
Hi all,I'm having some issues excluding events from our Juniper SRX logs. These events are ingested directly on our W...
by dsgoody Engager in Getting Data In 07-22-2025
0 2
0
2
verbal_666
Hello.I'm actually using aparallelIngestionPipelines = 2feature on my Indexers. Works.Servers (Linux) are professiona...
by verbal_666 Builder in Getting Data In 07-22-2025
0 5
0
5
Splunk Learning

Splunk has training and education options for everyone, whether it's your first or fiftieth deployment.

Get Started

Announcements
Register for Upcoming Live Tech Talks! Security, Observability, Platform and App Developer Editions are held every month.
Get Updates on the Splunk Community!

A Four-Part Event Series: State of Observability - Where AI Meets Performance

As AI agents take on more complex tasks, teams need greater visibility into how they behave, what they cost, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Build resilience for the agentic era: Join us at Splunk Go San Jose

AI is changing how organizations build, operate, and secure digital services. As teams adopt AI agents and ...
Top Karma Authors