its fine if we are monitoring in linux. what about windows? In windows unarchive_cmd=gzip -cd - will not work. ... View more

can anyone explain clearly is it possible or not? ... View more

Hi Vaishavai07, May I know Operating system of the forwarder splunk instance and Receiver splunk instance ( Indexer)?,hi vaishnavi, may I know from which OS you want to get the data in? OR OS of the forwarder? on which OS u have installed splunk server? OR OS of the Indexer(Receiver)? OS - operating SYstem ... View more

console log Consider using 'dppx' units, as in CSS 'dpi' means dots-per-CSS-inch, not dots-per-physical-inch, so does not correspond to the actual 'dpi' of a screen. In media query expression: (-webkit-min-device-pixel-ratio: 2), (min-resolution: 192dpi) Consider using 'dppx' units, as in CSS 'dpi' means dots-per-CSS-inch, not dots-per-physical-inch, so does not correspond to the actual 'dpi' of a screen. In media query expression: only screen and (-webkit-min-device-pixel-ratio: 1.5), only screen and (min-resolution: 144dpi) Resource interpreted as Script but transferred with MIME type text/plain: "http://10.215.3.195:8000/en-GB/static/@207789:10003/app/Symantec_DLP/table_row_highlighting.js". mtd_dlp_incidents?earliest=0&latest=:676 Uncaught SyntaxError: Unexpected token ; table_row_highlighting.js:38 Consider using 'dppx' units, as in CSS 'dpi' means dots-per-CSS-inch, not dots-per-physical-inch, so does not correspond to the actual 'dpi' of a screen. In media query expression: (min-resolution: 144dpi) mvc.js:6 Consider using 'dppx' units, as in CSS 'dpi' means dots-per-CSS-inch, not dots-per-physical-inch, so does not correspond to the actual 'dpi' of a screen. In media query expression: only screen and (-webkit-min-device-pixel-ratio: 1.5), only screen and (min-resolution: 144dpi) mvc.js:6 Resource interpreted as Image but transferred with MIME type image/x-png: "http://10.215.3.195:8000/en-GB/static/@207789/img/skins/default/loading_medium_green_2x.png". ... View more

and one more thing what ever is appearing on the dashboard it is not showing the color when i generated pdf. ... View more

and one more thing what ever is appearing on the dashboard it is not showing the color when i generated pdf. ... View more

return _(['severity']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = cell.value; // Apply interpretation for number of historical searches if (cell.field === 'severity') { if (value=='High') { $td.addClass('range-cell').addClass('range-elevated'); } } // Apply interpretation for number of realtime searches if (cell.field === 'severity') { if (value=='Low') { $td.addClass('range-cell').addClass('range-severe'); } } // Update the cell content $td.text(value.addClass('string'); } }); i am getting every row in a green color even though i tried above snippet ... View more

in table row highlighting they are highlighting by using numeric values now i want to highlight by using text inside the field.please help me // Apply interpretation for number of historical searches if (cell.field === 'severity') { if (value =='High') { $td.addClass('range-cell').addClass('range-elevated'); } } // Apply interpretation for number of realtime searches if (cell.field === 'severity') { if (value == 'Low') { $td.addClass('range-cell').addClass('range-severe'); } } // Update the cell content $td.text(value.addClass('string'); } ... View more

how to use code the which showing bottom of the each dashboard. ... View more

Thank you so much.. ... View more

I want to display the time range used for the search that generated the data and description also on the PDF ... View more

inputs.conf [udp://514] connection_host = ip index = main source = sourcetype = dlp_fireeye disabled = 0 on 514 im getting two types of logs if i change index in inputs.conf both logs get indexed to that index. ... View more

[set_sourcetype_dlp] REGEX= DLP FORMAT = sourcetype::dlp DEST_KEY = MetaData:Sourcetype [set_index_dlp] REGEX= DLP FORMAT = dlp DEST_KEY = _MetaData:Index [set_sourcetype_fireeye_malware_alerts] REGEX= fenotify FORMAT = sourcetype::fireeye_malware_alerts DEST_KEY = MetaData:Sourcetype [set_index_fireeye_csv] REGEX= fenotify SOURCE_KEY = MetaData:Host FORMAT = fireeye_csv DEST_KEY = _MetaData:Index ... View more

regex=DLP for dlp and regex=fenotify for fireeye_csv. dlp is working, data getting indexed to dlp and fireeye_csv is not. ... View more

my regex correct only, getting dlp logs from only one host:10.215.2.55 and fireeye logs from only one host:10.201.50.240 ... View more

dlp: Sep 5 09:10:37 10.215.2.55 Sep 5 09:10:37 DLP-BLR-ENF-SEC.wipro.com ID: 9713957, Policy Violated: SMTP Last Working Day, Count: 3, Protocol: SMTP, Recipient: haripriya.elangovan@gmail.com,kannan_shakthi@ymail.com, Sender: kalaiselvi.s19@wipro.com, Severity: 1:High, Subject: FW: Mega Employee Referral Walk-In Opportunities for Associate, Target: N/A, Filename: N/A, Blocked: Passed, Endpoint: N/A Sep 5 09:07:56 10.215.2.55 Sep 5 09:07:56 DLP-BLR-ENF-SEC.wipro.com ID: 9713945, Policy Violated: SMTP Customer Data Monitoring, Count: 12, Protocol: SMTP, Recipient: dinesh.maksat@gmail.com,niklesh.gupta2@wipro.com,Devender.Thakur@airtel.com,abinish.bhakhan1@wipro.com,amit.tanwar5@wipro.com,a_vivek.tanwar@in.airtel.com,wajahat.shreemal@gmail.com,rajeev.sharma4@wipro.com,rohit.kumar44@wipro.com,ashutosh.singh20@wipro.com, Sender: amit.bhardwaj3@wipro.com, Severity: 1:High, Subject: TO BE ADD IN NMS, Target: N/A, Filename: N/A, Blocked: Passed, Endpoint: N/A ... View more

props.conf [source::udp:514] TRANSFORMS-include = set_sourcetype_dlp, set_index_dlp, set_sourcetype_fireeye_malware_alerts, set_index_fireeye_csv ... View more

transforms.con [set_sourcetype_dlp] SOURCE_KEY = MetaData:Host REGEX=^host::(10.215.2.\55+)$ FORMAT = sourcetype::dlp DEST_KEY = MetaData:Sourcetype [set_index_dlp] SOURCE_KEY = MetaData:Host REGEX=^host::(10.215.2.\55+)$ FORMAT = dlp DEST_KEY = _MetaData:Index [set_sourcetype_fireeye_malware_alerts] SOURCE_KEY = MetaData:Host REGEX=^host::(10.201.50.\240+)$ FORMAT = sourcetype::fireeye_malware_alerts DEST_KEY = MetaData:Sourcetype [set_index_fireeye_csv] SOURCE_KEY = MetaData:Host REGEX=^host::(10.201.50.\240+)$ FORMAT = fireeye_csv DEST_KEY = _MetaData:Index ... View more

only once i got the data to index. not getting data continuously to index ... View more