Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About cdp_fap
cdp_fap
Observer
Member since:
02-29-2020
12-13-2023
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-29-2020 |
Activity Feed
- Posted Using Splunk Clound free trial, the SSL is enable for HEC where is the certifcate on Getting Data In. 12-12-2023 08:58 PM
- Posted Can Splunk HEC enable client authentication? on Splunk Enterprise Security. 09-13-2022 08:16 AM
- Posted How to avoid influence of equal sign in text string when Splunk HEC parses JSON? on Getting Data In. 08-02-2022 07:18 PM
- Posted Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs. on Getting Data In. 05-11-2020 06:49 AM
- Posted Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs. on Getting Data In. 05-11-2020 06:25 AM
- Posted Re: Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs. on Getting Data In. 05-11-2020 05:59 AM
- Posted Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs. on Getting Data In. 05-11-2020 03:21 AM
- Tagged Splunk HEC extract value incorrect when there is curly braces in value of key-value pairs. on Getting Data In. 05-11-2020 03:21 AM
- Posted Re: How to set up time properly? on Getting Data In. 04-10-2020 07:14 AM
- Posted How to set up time properly? on Getting Data In. 04-10-2020 05:51 AM
- Tagged How to set up time properly? on Getting Data In. 04-10-2020 05:51 AM
- Tagged How to set up time properly? on Getting Data In. 04-10-2020 05:51 AM
- Posted Can Monitor files and directories and HTTP Event Collector use the same name of source data type on Splunk Search. 03-01-2020 12:12 AM
- Tagged Can Monitor files and directories and HTTP Event Collector use the same name of source data type on Splunk Search. 03-01-2020 12:12 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-12-2023
08:58 PM
The ssl is enabled and can not change when using Splunk Clound free trial, where I can find/download the certificate.
... View more
Labels
- Labels:
-
HTTP Event Collector
09-13-2022
08:16 AM
I want to enable client authentication. so I midify $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf
[http] disabled = 0 enableSSL = 1 port = 56606 serverCert = /opt/splunk/cert/service.pem requireClientCert = true
I have copy the certificate of my application (myapp.cert) into splunk server. How can I enable myapp.cert into splunk HEC
... View more
Labels
- Labels:
-
configuration
08-02-2022
07:18 PM
I was tring to ingest data into Splunk via HEC. One field of my data is:
myKey1 = " This is my Application message log, myKey2=myValue2 in the text." There is a Key=VALUE enclosed in the value of Field_name.
Splunk will parse the data into two key:
myKey1 = " This is my Application message log, KEY=VALUE in the text."
myKey2=myValue2
myKey2=myValue2 is part of the myKey1.
I don't want it. What I can do to avoid the influence of an equal sign in the text string?
... View more
Labels
- Labels:
-
field extraction
05-11-2020
06:49 AM
{RCD=MC, ASID=006F, TIMESTAMP=20132 07.04.48.140 -0400, SMFID=MYSSTEM , TEXT=" +This is a control {line FAPFENG} This is the last message line", path=SYSLOG, timezone=-0400, sourcetype=SYSLOG-logmsg, system=XY}
... View more
05-11-2020
06:25 AM
Yes JSON fomat. something like: {key1=value1, key2=value2,....key3="xxxx{yyyyy", keyn1=valuen1}. The curly brace in value3 will result incorrect event parse.
... View more
05-11-2020
05:59 AM
I receiver data via SPLUNK HEC, and the {} is in data, not in the filed name.
... View more
05-11-2020
03:21 AM
Using HTTP Event Collector to receier data. When there is unwanted curly brace(s) in value. Event parse incorrect. How can I extract the data when there is {} in the data?
... View more
- Tags:
- splunk-enterprise
04-10-2020
05:51 AM
I use TIME_PREFIX and TIME_FORMAT to recognize the timestamp of my logs. There is a field, named timezone. It is the timezone of the logs. This value depends on the system generated the logs. It may be timezone=-0400, timezone=+0000 etc. That depends on the coming data. How I can I set the timezone so that _time will adjust correct.
For example:
TIMESTAMP= 2020/04/10 08:20:50.370
timezone = -400
Local timezone of my SPLUNK is +0800, How to set the timezone so that 2020/04/10 08:20:50.370 can be convert to my local time 2020/04/10 20:20:50.370. When I search my data , I want the Time(_time) will shown as my local time.
... View more
03-01-2020
12:12 AM
My application wants to sent dat to SPLUNK via Monitor files and directories and meantime via HTTP Event Collector. My application will format the data them required. Can I use the same data source type to sent to data with different format via different method(Monitor files and directories and meantime via HTTP Event Collector).
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-13-2023
12:03 AM
|
