...arsed by splunk. So that leaves me with _raw as a field for my whitelist. Is there a way to do the whitelisting of specific content in the _raw field? Or any other way?
...t says: By default a datamodel will search across all indexes. Use the configuration panel below to constrain data model searches to specific indexes.
Does checking the checkbox next to an index exclude...
Hey People!
My search head is running out of disk storage (recently). While checking, get to know many files *.bundle.info are getting created at $SPLUNK_HOME/var/run.
Just as a work around, i g...
How to exclude some indexes from authentication data model?
We have some indexes such as lastchanceindex, but eventtype was defined within Splunk_TA_nix.
Any clues?
Thanks.
...ime data is always unchanged and is determined by the application generating the event, or Splunk.
A small example: we have suite of servers physically located in Korea. The events are showing an o...
...lement).
Field Extraction. A few questions:
What field names should I use? Should they include the XPath of how to get to the element or attribute?
Can fields overlap, so (using the example a...
...hat I have is... is there a query example that you can point me to that would show how to excludespecific date ranges such as day of the week and hour for example exclude sat and Sunday. We are trying t...
...ource, the event timestamp is the first timestamp value in each incoming line.
By first, I am referring to the serialized JSON Lines input data, which might arrive in Splunk over a TCP network or f...
I'm trying to figure out how to have data from a particular host (i.e. Source) sent to a specific index. To get more specific for my example, I am trying to send Syslog data in on UDP 514. I would l...
Hello everyone. I am very new to Splunk and I am trying to filter logs before they reach the indexer. I literally hit the 500mb daily cap in 20 minutes, especially with security logs. Does anyone hav...