I am not sure how to fix the date extraction from a raw log which is done by default by Splunk. Splunk extracts date by default and it's not doing the year correctly. This is the raw log: Jun 21 00:00:32 10.20.14.12 Jun 20 17:00:32 : 2016/06/20 17:00:32 PDT,1,7016505,L2 Poll Failed,0,10596,,LAB,10.18.8.1,,L2 Poll failed to read hosts from LAB. And this is date that is getting extracted: 6/20/12 5:00:32.000 PM Anyone knows how to fix it? ... View more

I just finished an integration of the SCCM App and Splunk using Splunk DB Connect 2. Not sure where is the issue, but I've been seeing the same exact logs getting pulled from SCCM every 10 minutes (this is what I set the intervals to). The only different field is the time since it's 10 minutes different from each other, but the logs are identical. Example: 1. time, raw log 2. time + 10 minutes, same raw log as above 3. time + 10 minutes + 10 minutes, same raw as above (#1) 4. etc. How can I fix it to make Splunk DB Connect pulls the logs only once and make it aware of the same logs? ... View more

Has anyone done Splunk and Proofpoint Cloud instance integration? I am looking for help to pull the logs from Proofpoint via APIs or any other methods from the Proofpoint cloud instance. ... View more

I am getting this error while trying to integrate Nessus logs with Splunk: 2016-05-13 04:55:06,583 ERROR pid=9133 tid=MainThread file=nessus.py:get_nessus_modinput_configs:157 | Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus.py", line 147, in get_nessus_modinput_configs input_conf = config.get_data_input(input_name) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus_config.py", line 186, in get_data_input check_conf_mgr_result(False, "Cannot get the encrypted keys.") File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus_config.py", line 27, in check_conf_mgr_result raise NessusConfigException(msg) NessusConfigException: Cannot get the encrypted keys. Any idea how to resolve it? ... View more

I am looking for TA for DNS logs from 2012 R2 DNS servers. Would TA-DNSServer-NT6 work? I believe TA-DNSServer-NT6 was created for Windows 2008 R2 DNS Services. ... View more

I just updated Splunk Enterprise to 6.4, but the GUI for the Checkpoint add-on seems to be broken now. It doesn't show any tables but the "loading" icon, see the screenshot. Did anyone fix it already? ... View more

I am building a dashboard and I've been having an issue with presenting Statistics Tables on the dashboard while logged in as another user. I wanted to set it up on the big screens in the SOC using another user account. After I created all dashboards, they are all showing fine, except for the Statistics Table ones. Any idea why I can't show Statistics Tables dashboard to other users via dashboards. I can see it fine on my screen, but on the big screens it shows "No results found". ... View more

I've been trying to extract domains from AD DNS logs with the following rex and it's not really working well: [win] SEDCMD = s/(\d+)/./g I am still getting leading and trailing periods, for example: .www.google.com. The raw logs has parentheses with number of letters in it. (3)www(6)google(3)com Any other idea how to do it right? ... View more