Hi All,    I'm tweaking my inputs.conf file to exclude some events for the Windows Security log. I'm filtering EventCode 4688, by message.  For compatibility reasons, I want to use the same inputs.conf file for all windows machines.  But Windows 11 has tweaked a couple event logs, and one of those is 4688. For Windows 10 and below the following blacklist is working as expected: blacklist1 = EventCode="4688" Message="Token Elevation Type:(?!\s*%%1937)" This filters everything except %%1937. But this won't work for Windows 11, because they have changed the Token Elevation Type to "TokenElevationTypeFull" for the previously "%%1937".  Therefore if a windows10 inputs.conf file ends up on a windows 11, it blacklists all the 4688 logs. So simply, I would like to add the 2 lines together on a single line, so that if either TokenElevationType is found, it goes through.  But the "|" operator doesn't seem to be working, or I'm not doing the correct syntax. blacklist1 = EventCode="4688" Message="Token Elevation Type:(?!\s*%%1937)" blacklist1 = EventCode="4688" Message="Token Elevation Type:(?!\s*TokenElevationTypeFull)"   Can anyone help marry these 2 checks with an OR operator?   Thank you

Hi I am trying to create new column in table after extracting information from json data, new column have value "True" or "False" if "toDomain" column data available in  lookup table . Querry: index="pps_index" sourcetype="pps_messagelog" "filter.routeDirection"=outbound |rex field=envelope.rcpts{} .*@(?<toDomain>.*)|rex field=envelope.from .*@(?<fromDomain>.*)|rename envelope.from as Sender envelope.rcpts{} as Recipient msg.header.subject as Subject msgParts{}.detectedName as Attachment | table Sender Recipient Subject Attachment toDomain lookup file "publicDomain.csv" contains below data as example. publicDomain 123.com 123box.net 123india.com 123mail.cl 123qwe.co.uk 126.com 15meg4free.com 163.com 163.net 169.cc 188.net current output: Sender  Recipient  Subject Attachment toDomain Ruotong_Yin@contractor.amat.com ngarza@littelfuse.com RE: AMAT PO 4513405497 11.26.2021 Littelfuse Inc. text.txt text.html lt po# 4513405497.pdf littelfuse.com Amanda_Mo@amat.com cod.b2b.servicerequest@my344310.mail.crm.ondemand.com RE: [ Ticket: 3018517 ] WF: WF: 25420987000020 & 25420672000020-- 0190-17499W * (1+1) =2EA--- pls create STO from 8665 & 8639 to 8602. thank you! text.txt text.html image005.jpg image006.png image001.jpg image002.jpg image007.jpg my344310.mail.crm.ondemand.com Amanda_Mo@amat.com hfamat.list@bondex.com.cn RE: [ Ticket: 3018517 ] WF: WF: 25420987000020 & 25420672000020-- 0190-17499W * (1+1) =2EA--- pls create STO from 8665 & 8639 to 8602. thank you! text.txt text.html image005.jpg image006.png image001.jpg image002.jpg image007.jpg bondex.com.cn   tme@massgroup.com tme@123box.net Work Order Past Due Notification: WO# 199996 text.txt 123box.net   Desired Output: Sender  Recipient  Subject Attachment toDomain PDVal Ruotong_Yin@contractor.amat.com ngarza@littelfuse.com RE: AMAT PO 4513405497 11.26.2021 Littelfuse Inc. text.txt text.html lt po# 4513405497.pdf littelfuse.com False Amanda_Mo@amat.com cod.b2b.servicerequest@my344310.mail.crm.ondemand.com RE: [ Ticket: 3018517 ] WF: WF: 25420987000020 & 25420672000020-- 0190-17499W * (1+1) =2EA--- pls create STO from 8665 & 8639 to 8602. thank you! text.txt text.html image005.jpg image006.png image001.jpg image002.jpg image007.jpg my344310.mail.crm.ondemand.com False Amanda_Mo@amat.com hfamat.list@bondex.com.cn RE: [ Ticket: 3018517 ] WF: WF: 25420987000020 & 25420672000020-- 0190-17499W * (1+1) =2EA--- pls create STO from 8665 & 8639 to 8602. thank you! text.txt text.html image005.jpg image006.png image001.jpg image002.jpg image007.jpg bondex.com.cn False   tme@massgroup.com tme@123box.net Work Order Past Due Notification: WO# 199996 text.txt 123box.net True   Kindly provide solution to resolve issue.  

Hello to everyone, on my indexers I just configured Splunk as a service with systemd, start command works fine but stop command (systemctl stop Splunkd), instead, returns some errors: [root@pe-sec-idx-02 system]# systemctl status Splunkd ● Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start' Loaded: loaded (/etc/systemd/system/Splunkd.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Wed 2022-01-12 15:18:32 CET; 9s ago Process: 1462 ExecStop=/opt/splunk/bin/splunk _internal_launch_under_systemd (code=exited, status=1/FAILURE) Process: 31484 ExecStop=/bin/sleep 10 (code=exited, status=0/SUCCESS) Process: 31225 ExecStop=/sbin/runuser -l splunk -c /opt/splunk/bin/splunk edit cluster-config -manual_detention on -auth admin:D1c3mbr3Sec (code=exited, status=0/SUCCESS) Process: 20750 ExecStartPost=/bin/bash -c chown -R 1001:1001 /sys/fs/cgroup/memory/system.slice/%n (code=exited, status=0/SUCCESS) Process: 20746 ExecStartPost=/bin/bash -c chown -R 1001:1001 /sys/fs/cgroup/cpu/system.slice/%n (code=exited, status=0/SUCCESS) Process: 20643 ExecStartPost=/sbin/runuser -l splunk -c /opt/splunk/bin/splunk edit cluster-config -manual_detention off -auth admin:D1c3mbr3Sec (code=exited, status=0/SUCCESS) Process: 19156 ExecStartPost=/bin/sleep 60 (code=exited, status=0/SUCCESS) Process: 19155 ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd (code=exited, status=52) Main PID: 19155 (code=exited, status=52) Jan 12 15:12:20 pe-sec-idx-02 splunk[19155]: All installed files intact. Jan 12 15:12:20 pe-sec-idx-02 splunk[19155]: Done Jan 12 15:12:21 pe-sec-idx-02 splunk[19155]: Checking replication_port port [9887]: 2022-01-12 15:12:21.354 +0100 splunkd started (build 7651b7244cf2) Jan 12 15:13:17 pe-sec-idx-02 systemd[1]: Started Systemd service file for Splunk, generated by 'splunk enable boot-start'. Jan 12 15:18:03 pe-sec-idx-02 systemd[1]: Stopping Systemd service file for Splunk, generated by 'splunk enable boot-start'... Jan 12 15:18:16 pe-sec-idx-02 systemd[1]: Splunkd.service: control process exited, code=exited status=1 Jan 12 15:18:16 pe-sec-idx-02 splunk[19155]: 2022-01-12 15:18:16.021 +0100 Interrupt signal received Jan 12 15:18:34 pe-sec-idx-02 systemd[1]: Stopped Systemd service file for Splunk, generated by 'splunk enable boot-start'. Jan 12 15:18:34 pe-sec-idx-02 systemd[1]: Unit Splunkd.service entered failed state. Jan 12 15:18:34 pe-sec-idx-02 systemd[1]: Splunkd.service failed. Despite the output, service stops successfully. As you can see, I added some instructions in the service unit file to put the indexer (which is part of a cluster) in manual detention before stopping it, and also it turns manual detention off once Splunk is started. I say again that stop/start commands work good, but in any case I get the above error messages when I stop the service. Am I doing something wrong? This is my service unit file: #This unit file replaces the traditional start-up script for systemd #configurations, and is used when enabling boot-start for Splunk on #systemd-based Linux distributions. [Unit] Description=Systemd service file for Splunk, generated by 'splunk enable boot-start' After=network.target [Service] Type=simple Restart=always ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd ExecStartPost=/bin/sleep 60 ExecStartPost=/sbin/runuser -l splunk -c '/opt/splunk/bin/splunk edit cluster-config -manual_detention off -auth admin:D1c3mbr3Sec' ExecStop=/sbin/runuser -l splunk -c '/opt/splunk/bin/splunk edit cluster-config -manual_detention on -auth admin:D1c3mbr3Sec' ExecStop=/bin/sleep 10 ExecStop=/opt/splunk/bin/splunk _internal_launch_under_systemd LimitNOFILE=64000 LimitNPROC=16000 SuccessExitStatus=51 52 RestartPreventExitStatus=51 RestartForceExitStatus=52 User=splunk Delegate=true CPUShares=1024 CPUQuota=1400% MemoryLimit=30G PermissionsStartOnly=true ExecStartPost=/bin/bash -c "chown -R 1001:1001 /sys/fs/cgroup/cpu/system.slice/%n" ExecStartPost=/bin/bash -c "chown -R 1001:1001 /sys/fs/cgroup/memory/system.slice/%n" KillMode=mixed KillSignal=SIGINT TimeoutStopSec=10min [Install] WantedBy=multi-user.target  

Not getting data ofter configuring TCP 80 port in inputs.conf my stanza is like this [tcp://80] connection_host = dns index = port sourcetype = syslog can you give me any idea on this. thnks in advance.

hi all, i would like to ask if it is possible to include IF condition in the search query   if msg="Security Agent uninstallation*" [perform the below] | rex field=msg ":\s+\(*(?<result>[^)]+)" | table _time msg result   if msg="Security Agent uninstallation command sent*" [perform the below] | rex field=msg "^[^;\n]*;\s+\w+:\s+(?P<endpoint>.+)" | table _time msg suser endpoint

Hello all I want to create a lookup file with an owner, in a specific App, and vith sharing = App.   I used the command  :  | outputlookup create_context=user  file.csv I'm using the endpoint  : /servicesNS/<username>/<namespace>/search/jobs   It creates a lookup file with an owner, in a the specific App but with sharing = Private and the file is not visible to other app users.    Does anyone have a solution to this please ? 

  Info: Bounced: DCID 8413617 MID 19338947 From: <MariaDubois@example.com> To: <abcdef@buttercupgames.com> RID 0 - 5.4.7 - Delivery expired (message too old) ('000', ['timeout']) O/p: from_mail_id = MariaDubois@example.com to_mail_id = abcdef@buttercupgames.com Please help me with the Solution ,Thanks 

Hi, I am not able to change the color of graph , tried multiple options in source code , everytime the same color is reflecting . I want three different colors for 3 different results ( in this case - succeeded , failed , aborted)  Query  </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.maximumNumber">500</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">none</option> <option name="charting.fieldColors">{"succeeded": 0x425b3c, "failed": 0x5b3c53, "aborted": 0xc98b06}</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">none</option> <option name="charting.lineWidth">2</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">0</option> <option name="trellis.size">small</option> <option name="trellis.splitBy">projects</option> </chart>  

Greetings!!   I need help!!! am experiencing an error while am doing search, the error is: Search peer Splkidx04 has the following message: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch.   Problem replicating config (bundle) to search peer ' 10.10.x.96:8089 ', HTTP response code 500 (HTTP/1.1 500 Error writing to /opt/splunk/var/run/searchpeers/Splunksh1-1641956462.bundle.4ef204fd344a6181.tmp: No space left on device). Error writing to /opt/splunk/var/run/searchpeers/Splunksh01-1641956462.bundle.4ef204fd344a6181.tmp: No space left on device (Unknown write error) . 1/12/2022, 10:44:22 AM The search process with sid=scheduler__pacyn__search__RMD5837e19b530431259_at_1641973200_94478 on peer=Spkidx4 might have returned partial results due to a reading error while waiting for the peer. This can occur if the peer unexpectedly closes or resets the connection during a planned restart. Try running the search again. Learn more. 1/12/2022, 9:43:09 AM Search peer Splkidx4 has the following message: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch. 1/12/2022, 10:59:00 AM   5 errors has occurred while the search was executing. therefore search results might be incomplete. hide .....   Kindly help me on how i can fix this above issue.  Thank you in advance!    

Is there a way to add a field to an event from a different event assuming they have a common key using a simple search (without using pipe)? The reason being the resulting event will need to be tagged via event type (which doesn't allow complex search) so it can be included as part of a data model. For example, Event 1 - field A (common key): ABC, field B: Sunny Event 2 - field A (common key): ABC, field C: Morning Resulting Event 1: field A: ABC, field B: Sunny, field C: Morning The final event will then be tagged so it can be included in the data model. Appreciate any advice/suggestion.