How Splunk Handles Data

How Splunk Handles Data

Splunk is handling multiple events as one. Splunk is splitting multiple line events in the wrong place. How do I fix that?

You can override Splunk's default multiline event handling rules by editing properties set by source or sourcetype. Complete instructions can be found in the Admin Manual. You can see examples in the example files in $SPLUNK_HOME/splunk/etc/bundles/.

Splunk is not recognizing my timestamps correctly. How do I fix that?

You can train Splunk to recognize timestamps better. Run $SPLUNK_HOME/bin/splunk train dates to teach Splunk the dates to extract from your datasources.

I want to add custom fields such as user:: to the default fields like source::. How do I do that?

You can specify additional fields to be indexed or extracted at search time in properties configuration files. Instructions can be found in the Admin Manual. You can see examples in the example files in $SPLUNK_HOME/etc/bundles/props.conf.example and $SPLUNK_HOME/etc/bundles/transforms.conf.example.

I have some sensitive data. Can I garble it before it gets indexed?

Yes. There is an anonymizer you can use to maintain confidentiality. Please see the section of our Admin Manual on Anonymizing your Data Samples.

I want to search for messages in my email logs based on both sender and recipient, but these are recorded in different events with a common message id. Can Splunk handle that?

Yes. You will have to configure Splunk to recognize the common field and use the "transaction" search command to connect all events with that field in common. You can see examples in the Admin Manual.

Does Splunk read milliseconds?

Yes, introduced in Splunk 3.2, we now have support for parsing milliseconds as part of the indexed timestamp field