What problem are you trying to solve by adding a heavy forwarder environment? ... View more

I think you might just be missing a "BY" clause... index="indexA" servco_name="store*" servtype_id="CFAIL" | rename zip_code as Zipcode | lookup zip_code Zipcode OUTPUT Lat Long | geostats latfield=Lat longfield=Long Sum(Count) BY Zipcode ... View more

Please provide sample data ... View more

We create a new file per device type every hour and throw away files in 72 hours. ... View more

If you want to truly make this a checkpoint of the message, you might consider writing a checkpoint module that you script runs after it downloads the data. I have done something similar in powershell, but not python. I took a list of two columns, concatenated each pair and then hashed them. I then searched the hashes for previous matches. You could do the same thing with the last message read. Hash all the messages and save and save the last one in a batch as a checkpoint. When you pull the next batch of messages only forward the ones that come in after your checkpoint hash is matched. ... View more

If you still find that you are struggling with this objective, you can run a search, download the reulting "spreadsheet" and perform your comparison in excel or whatever similar tool you have available. Here is a sample search that should get you the hosts sending data to splunk: |tstats count where index=* by host ... View more

The Dynatrace app for Splunk collects via the Dynatrace API: https://splunkbase.splunk.com/app/4040/ ... View more

The Dell EMC NetWorkers getting started with API documentation speaks to time filtering in chapter 4 page 35: https://www.dellemc.com/pl-pl/collaterals/unauth/technical-guides-support-information/products/data-protection/docu94007.pdf ... View more

Was this issue ever resolved? I am seeing the same issue in my SplunkCloud environment. ... View more

MS Teams is part of the o365 app for Splunk, which is SplunkCloud certified https://splunkbase.splunk.com/app/4055/ ... View more

I do not see any difference in time between the two searches. How are you assessing was denied vs is allowed? If you have more than one firewall sending logs to the index it could be permitted by the first to see the traffic and denied by the second, the overall effect would be the traffic was denied for your enterprise firewalls but the interpretation of your data would be once denied but now permitted. Or, the inverse could be true, it was once permitted but now is denied. If I understand the objective of your search, you would need to perform the searches across to different time periods and look for src_ip dest_port "denied" in the earliest query and in the query of the newer data look for the absence of denied for the same pattern of src_ip dest_port. Then by combining the results you could measure the status of the present against the historical record. Unless this search is isolated to an edge (or small number of edge) firewall(s) and a timeshift between the two searches is added, I do not see how this is manageable. Of course, I might be way off base too... ... View more

Event filtering is one of the primary reasons to use an HF as an intermediate forwarder. Your license is not impacted until data reaches the IDX. Why not blacklist the undesired traffic there? ... View more

Extracting fields in Splunk can be done on interactivley in the search operation but is most often performed when the data is brought in to Splunk. Most products have the field extraction work done for you in a construct called an add-on, which are available at Splunk's app store, splunkbase.splunk.com. If there is a need to create extractions from a custom log source, you can do that by creating your own configuration files to have it applied to the data for all users at search time or in the Search Processing Language (SPL) (similar to the search you provided). However, specifying acurate field extractions without sample data is not recomended, like impossible to do. Here are a couple different links to field extraction documentation that you can read if you want more information: https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Automatickey-valuefieldextractionsatsearch-time https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles As for the search logic... Some of the functionality in your search seems the same and some I will take sonme artistic liberty to explain how I would do it in Splunk based on your description. Timeslice looks like bucket (Alias for the bin command) in Splunk | bucket span=5m Documentation--> https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Bin max() in Splunk is an aggregate function. The max() 'command' is an argument to a higher level function (chart, stats, timechart, sparkline()). The higher level function effects the output/visualization of the data. Documentation--> https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Aggregatefunctions sum() is another aggregate function in Splunk and is documented on the same page as max() Math in Splunk looks different than what you are accustomed to. Again it is processed as an argument for the eval function. Documentation--> https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/MathematicalFunctions The compare function that you show in the last line could be performed as a function of the search. In Splunk I think I would build out this data collection as a metrics store and run my search accross it. Documentation--> https://docs.splunk.com/Documentation/Splunk/8.0.1/Metrics/Overview I don't think this is exactly what you wanted, but it is what I can offer. I hope you find it helpful. ... View more

Try running this to see what indexes are being populated: |tstats count where index=* by index Use the past 24 hours in time picker. This will show any index being written to in your environment. Verify that you see the index you desire to query in the results. ... View more

What is the result of | inputlookup productext.csv ... View more

This question is covered real well in this answer: https://answers.splunk.com/answers/750048/see-user-activity-by-app-and-view.html ... View more

In the future please use the "code sample" applet to insert SPL. Without using the applet special characters and other formatting may not represented correctly. ... View more

You can configure the syslog server with a different IP address for each sourcetype you wish to define. Each IP should write to its own file(s) and your monitor statement should establish the sourcetype. Here is a link to a Splunk Blog that goes into detail about syslog architecture: https://www.splunk.com/en_us/blog/tips-and-tricks/syslog-ng-and-hec-scalable-aggregated-data-collection-in-splunk.html and here is a link to the author's .conf presentation: https://conf.splunk.com/files/2017/slides/to-hec-with-syslog-scalable-aggregated-data-collection-in-splunk.pdf If you are only just getting started with syslog/Splunk, you should really consider a mature deployment like those suggested above. ... View more

The "greater than" and "less than" signs must be encoded differently. Try using < in place of "less than" and > in place of "greater than" <row> <panel> <viz type="status_indicator_app.status_indicator"> <search> <query>host="HOST-1" | eval server="SERVER-1" | stats count by server | eval color=if(count<=0, "#dc4e41", "#65a637"),icon=if(count<=0, "times-circle", "check-circle") | table server icon color</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">background</option> <option name="status_indicator_app.status_indicator.fixIcon">warning</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">3</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">false</option> </viz> </panel> </row> ... View more

Give this a look and see if it is what you are after... index=same-index source="same-source" "first-query-static-text" | bucket _time span=1d | timechart count AS first_query_count | appendcols [ search index=same-index source="same-source" | regex log="second-query-regex" | bucket _time span=1d | timechart count AS second_query_count | fields second_query_count] ... View more

who does ip xxx connect to and on what port... index=Your_index sourcetype="pan:traffic" src_ip="x.x.x.x" | stats count by dest_ip dest_port who connects to ip xxx and on what port... index=Your_index sourcetype="pan:traffic" dest_ip="x.x.x.x" | stats count by src_ip src_port ... View more

The regex would need to be created specifically for the event. It would be a custom field extraction based on the event syntax. Without an event, it is impossible to create a reliable regex for the field extraction you desire. ... View more

@woodcock It's not my data, or my question, just trying to learn from Master Yoda. I didn't follow the data in the question either, so I was using this to derive an answer... | makeresults | eval data="2-Jan-20 16:00:00,10;2-Jan-20 16:30:00,14;1-Jan-20 15:35:00,10;1-Jan-20 17:34:00,14;3-Jan-20 16:50:00,10;3-Jan-20 17:34:00,14" | makemv data delim=";" | mvexpand data | rex field=data "(\s|\n?)(?<data>.*)" | makemv data delim="," | eval _time=strptime(mvindex(data,0),"%d-%b-%y %H:%M:%S"), ErrorCount=mvindex(data,1) | fields _time ErrorCount | eval "Average Event Time"=strftime(avg_event_time, "%H:%M") | stats earliest(_time) as FirstAppearance by _time | bucket _time span=1d | stats avg(FirstAppearance) AS avg_FirstAppearance | eval "Average First Appearance"=strftime(avg_FirstAppearance, "%H:%M") | table "Average First Appearance" ... View more

@woodcock I'm trying to follow your SPL, but getting stuck. Should line 2 read: | eval time=strftime(strptime(_time, "%H:%M:%S.%3M"), "%H%M%S%3M") ... View more