There is a field - req_status - for F5 Big IP ASM logs and right now when I view the values, I expect to see three: Passed Blocked Alerted However, when I view the values, I am seeing values that are truncated like as follows: "pa "p "pas "pass "passe " "passed Here is a snippet of the log (verbiage before and after the snippet): .....req_status="passed",resp="Logging rate limit reached"..... I tried using ,req_status=(\"\w+)", for my regex and it looks clean on regex101.com, but not Splunk. Any suggestions to clean up the regex would be greatly appreciated Thx ... View more

We are using the Splunk Shibboleth add on app but unfortunately our Shib audit events are formatted as JSON and it's nullifying the audit fields in the transforms.conf file: [shibboleth:audit-fields] DELIMS = "|" FIELDS = auditEventTime,requestBinding,requestId,relyingPartyId,messageProfileId,assertingPartyId,responseBinding,responseId,principalName,authNMethod,releasedAttributeId1,releasedAttributeId2,nameIdentifier,assertion1ID,assertion2ID All of the K/V pairs that should be parsed are in the 'Event' field in the JSON formatted event with the | delimiter. Is there a way to modify the transforms.conf file so that it looks in the Event field for the values to parse? ... View more

On my Deployment server in the /opt/splunk/etc/deployment-apps directory, I have the Splunk_TA_f5-bigip app with a local directory that contains a transforms.conf file. I reloaded the deploy server and then went to my Search Head cluster deployment server and verified that the transforms.conf file exists in /opt/splunk/etc/shcluster/apps/Splunk_TA_f5-bigip/local/ directory (and verified the contents of the file). I then applied the shcluster bundle to my three search heads and waited a few minutes before checking to see if the local folder and the transforms.conf file made it over, and it did not. Running ls shows no local folder under the Splunk_TA_f5-bigip directory on either of the three search heads. Am I missing a step to get the local folder with the transforms.conf file over from the Deployment server to the search head deploy serves and then finally to the three search head servers? Thx ... View more

I have the following search based on F5 logs that count the HTTP POSTs by src in a five-minute bucket: index=f5 action!=blocked http_method=POST | bucket _time span=5m | stats count by _time, src, website | sort -count | stats dc(website) as distinct_website, list(website) as Website, list(count) as count, sum(count) as Total by src | where distinct_website >= 3 | sort -Total The problem is, I get an output that lists the same websites multiple times: If I add '| dedup Website' before the 'where' command, I still see the duplicate websites. if I add '| dedup website' after the '| stats count by _time, src, website' command, the websites are deduped, but I see the following output that contains a different src and websites altogether: Do I need the dedup command at all for this search? Thx ... View more