Using REST API, you can pull data into Splunk. Here is a ready-made app for you - https://apps.splunk.com/app/1546/ For CSV, just point Splunk to that path. Splunk will automatically index that. ... View more

You may use Splunk Add-on for Check Point OPSEC LEA to get Checkpoint raw data into Splunk. https://apps.splunk.com/app/1454/ ... View more

Please post your questions..I am sure you will get answers. ... View more

You can use Splunk for Business Analytics. Please refer to http://www.splunk.com/content/dam/splunk2/pdfs/solution-guides/splunk-for-business-analytics.pdf Splunk allows customer analyze data in move or data in fly in real time where as BI is more suited for static data. Please note Splunk can't replace BI tools. But you can definitely integrate Splunk with BI tools such as Tableu, MicroStrategy etc. ... View more

Your problem might be related to below "known issue" http://docs.splunk.com/Documentation/MSApp/1.1.2/MSInfra/Releasenotes Current known issues The Splunk App for Windows Infrastructure has the following known issues: In certain cases, the app setup prerequisite check prevents you from proceeding even though all prerequisite checks have passed. To work around the problem, confirm that the Splunk Add-on for Windows and the Splunk Supporting Add-on for Active Directory (SA-LDAPSearch) have been activated (and not just installed) in the Apps page in Splunk Web. (TAG-9012) ... View more

Hi @mikaelbje - What if we run "show cdp neighbor" on Cisco network appliance & capture it using scripted inputs. This is what we are doing in Cisco Nexus 9K. ... View more

Hi Craig - Below search query might help you..Select Real-time from time range picker index=_internal source=*metrics.log group=search_concurrency user=* | eval total = active_hist_searches + active_realtime_searches | timechart max(total) by user agg=max useother=f limit=20 ... View more

Could you please share indexes.conf (mask imp information) ... View more

Hi - I indexed sample data provided by you but I did not see any loss. If its test environment, could you please clear the index & re-index your logs. ... View more

Hi garimayadav - Questions asked by you purely depends upon data volume/day, underlying hardware, deployment architecture, network latency. Following links will address your queries. Please have a look. http://docs.splunk.com/Documentation/Splunk/6.2.2/Capacity/Forwarder-to-indexerratios http://docs.splunk.com/Documentation/Splunk/6.2.2/Capacity/Referencehardware http://docs.splunk.com/Documentation/Splunk/6.2.2/Capacity/Performancechecklist http://docs.splunk.com/Documentation/Splunk/6.2.2/Capacity/Summaryofperformancerecommendations ... View more

Hi gfaggiano - Below link might help you. http://answers.splunk.com/answers/218189/forwarders-not-forwarding.html#answer-218190 ... View more

Don't we configure all indexes on a SH? Then deployer will maintain that config across other remaining SH? ... View more

Hi @vdevarayan - Please accept the answer and vote if above response helped you. ... View more

Could you please share sample logs & search, you are using. ... View more

Hi - You can create a lookup to enrich raw unstructured data with structured data. e.g. user1=1234, user2=3456 Below link provides information about creating lookup - http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usefieldlookupstoaddinformationtoyourevents Hope this helps. ... View more

Could you please refer to below link- http://answers.splunk.com/answers/218306/json-format-is-not-getting-indexed.html If that does not solve your problem, please share some sample logs. Thanks ... View more

could you please share some more information about your problem e.g. logs from splunkd ... View more

I see host1,host2,host3 are values in KV pair. You can create a chart that shows different values for these hosts. ... View more

I see your UF is connected to Indexer. Are you still facing problem? Here is command to enable receiving on indexer ./splunk enable listen 9997 ... View more

Outputs.conf seems to be missing. [tcpout] autoLB = true defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = 192.168.10.3:9997,192.168.10.4:9997,192.168.10.8:9997 Also check if you have enabled receiving on indexer with port 9997. If problem still persist, then check below & share result- tail -100f splunkd.log | grep TcpOutputProc ... View more

You can also refer below link for getting data into Splunk - http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/WhatSplunkcanmonitor ... View more

Very curious to know how points/badge gets updated... Does it depend upon number of answers/accepted answers ... View more