Search

mnizamuddin · ‎12-31-2020

Hello All, I'm having an issue where I am unable to create new correlation searches. I get the following error: There was an error saving the correlation search: In handler 'savedsearch': ...

bosseres · ‎02-11-2021

Hello Everyone, I have a question. I have events like: Mon Mar 19 20:16:03 2018 Info: Delayed: DCID 8414309 MID 19410908 From: <WeiZhang@example.com> To: <mcintosh@buttercupgames.com> R...

simonEA · ‎11-12-2020

Hi there, When reviewing Splunk events, some events display as below, it splits following text into two events; the second event has no datetime at the beginning, and the log is from log4net w...

alidrab · ‎01-08-2021

Hello, I have a log file where each event starts with a date, however, there are two date formats. There are multi lines in some of the events and some of the data are separated by a blank line. Upo...

ekenne06 · ‎01-29-2021

I followed this article https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Advancedsourcetypeoverrides basically I took sourcetype ABC and am doing some regex and searching for 123, if I f...

dloszews · ‎01-08-2021

We just got a new splunk cloud instance/stack (we now have a total of 2 splunk cloud instances) and attempting to send data to it from our Universal Forwarder. Currently the universal for...

nik_charusat · ‎01-21-2020

Does Universal Forwarder's load balancing work automatically in Distributed architecture without clustering?

rewritex · ‎12-20-2016

I believe i'm on the most current version, I'm not clear on why I am getting these messages.. When I click on the links, it takes me to the general products screen of Splunk. When I clear the message...

chris95 · ‎01-11-2021

Hello, I would like to retreive multiple value into a single field. Below an example of log where I would like to extract the value after "sha256":" until the next " [{"overall_...

ips_mandar · ‎11-17-2020

Hi I have currently 5-6 index setup where consider abc as fieldname , which is extracted at index time and same fieldname is called with different name in different indexes like cde, efg . Now...

Search

Search the Community

Splunk Enterprise Security not able to write/ read...

Regex during getting data in

Event has no datetime at the beginning splits into...

Multi line data with blank lines are splitting int...

Props isn't working on overrided sourcetype

Sending data to two splunk cloud instances from Un...

Load Balancing

Licensed Splunk Enterprise 6.5.0: How do I prevent...

Help Splunk query multiple values

Splunk CIM model