×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
chrissale
Explorer
Member since: ‎07-24-2013
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 2
Member Since ‎07-24-2013
Activity Feed
View All

Re: Disable forwarding of Windows Event Logs

by in Getting Data In
‎02-11-2014 04:05 AM
‎02-11-2014 04:05 AM
Hi Ayn, thanks for the quick response. I don't have $SPLUNK_HOME\etc\apps\MSIcreated . Never-the-less I added to following stanzas to $SPLUNK_HOME\etc\system\local\inputs.conf and that seems to have done the trick. [WinEventLog://Application] disabled = true [WinEventLog://Security] disabled = true [WinEventLog://System] disabled = true ... View more

Re: How to Handle Metadata in File Headers

by in Splunk Search
‎02-11-2014 03:45 AM
‎02-11-2014 03:45 AM
Thanks for the response yannK. I like where you are going with this but unfortunately I can't guarantee that the source name is unique or influence the naming strategy for the file. I am going to see if I can create a custom field at indexing time that uniquely identifies the file (CRC?) and use that for the lookup. ... View more

Disable forwarding of Windows Event Logs

by in Getting Data In
‎02-11-2014 03:27 AM
2 Karma
‎02-11-2014 03:27 AM
2 Karma
I am using a Universal Forwarder to collect events from a Windows server. In /etc/system/local I have created custom inputs.conf and outputs.conf to collect events from a log file and forward them on to an indexer. However, the indexer is also receiving events of the source type WinEventLog:Application, WinEventLog:System and WinEventLog:Security. How can I disable this? ... View more

How to Handle Metadata in File Headers

by in Splunk Search
‎02-10-2014 05:18 AM
‎02-10-2014 05:18 AM
I am using Splunk to collect data from log files generated by a thick client application. The log files contain metadata in the header relating to the user that logged on. I want to be able to search for events using the metadata in the file header (example below). username: myUser hostname: myHost 10/02/2014 13:12:03 INFO User did some stuff 10/02/2014 13:12:41 INFO User did some more stuff 10/02/2014 13:14:26 WARNING User did some stuff they weren't supposed to! In this example a search for 'username=myUser' would return all three events shown. Is that possible? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All