I am looking for anyone who might know the appropriate BIND logging configuration to capture DNS replies so that we can map these into the Network Resolution model in Enterprise Security. Logging the queries is simple enough and the MS DNS configuration was easy to discover for our AD devices. However, I can't seem to find the right BIND logging settings without using Debug Level 10 - which is far too much data. Any thoughts? I have not found any documentation on this - to ONLY log queries and responses in BIND. ... View more

We are taking in infoblox logs via syslog and are getting inconsistent results. We have a clustered environment. The infoblox app is installed on a search head and the infoblox data is coming in via syslog on an indexer. On the indexer, the sourcetype is manually set to infoblox:file. The last several days, the branch to infoblox:dhcp and infoblox:dns worked perfectly. Over the last couple days we are now only seeing infoblox:file, as if the sourcetype branches are no longer working. On the search head, we've verified the sourcetypes and the transforms. I can't seem to figure out why this is occurring. Do we need to install the infblox app on the indexer as well? This breaks Splunk Common Information Model (CIM) compliance and by extension Splunk Enterprise Security. Any advice on troubleshooting? Splunk Add-on for Infoblox Splunk_TA_infoblox 1.0.2 ... View more

Can you provide a function which returns a string in an if statement? For example: if(src=="-" OR src=="127.0.0.1", Computer, trim(Source_Workstation,"some string")) , reads as: if src = - or 127.0.0.1, return the value of the Computer field. Else, return as string value of trim, where some string has been removed. When I run this eval, the first result performs as expected. However, the trim statement returns 1 or 0. In testing, this reports whether the trim actually trimmed anything (1 for yes, 0 for no). If I pipe as separate command, then I get the expected results (e.g. eval src=trim(Source_Workstation,"some string")) . However, I want this to be in a calculated field extraction and I can't seem to have multiple calculations running over the same field (makes sense). This is an attempt to remove the leading "::ffff:" from some Windows event logs. ... View more

During searches in Enterprise Security, I get the following error: Empty csv lookup file (contains only a header) for table 'asset_lookup_by_cidr': /opt/splunk/var/run/searchpeers/{hostname}-1477514321/apps/SA-IdentityManagement/lookups/assets_by_cidr.csv We recently updated our asset information from Active Directory and our network data. When we look at the assets_by_cidr.csv lookup file, it is not populating after a merge. ... View more

I am trying to access splunk-launch.conf from REST API. I've been through the REST API documentation and still can't find the right way to access that end point. Does anyone know the right REST API endpoint for splunk-launch.conf? ... View more

If an analyst has added a notable event to an investigation, how does another analyst open that notable event to review it? There does not seem to be an option to view the raw event referenced in the timeline or jump to the all the notable events for an investigation. The same goes for Splunk Events. ... View more

Is there any listing of the what the "rec_type_simple" fields mean? For example, the events with rec_type_simple=PAYLOAD. ... View more