Here is an idea: install the app Splunk DB Connect, this will create a new External Databases in the Manager. Configure and test the access to the database. Schedule a database input using a database dump, this allow you to run a custom query and save the results in an index. Use the index instead of the lookup. If that doesn't work schedule a search that uses the outputlookup function to write a lookup file from that index. This might be a bit more messy, than the script depending on how complex a tash you are attempting. ... View more

Wasn't that what you required? Give an input and expected output example ... View more

outputlookup seems to solve it ... View more

I would have to edit all the searches on both server. They are like 300 of them, I will do if there is no other way ... View more

For clients to connect to the deployment server you have to give them an ip address and a port. So you need a port number. ... View more

You can configure this with the web GUI at: Manager > Access controls > Authentication method Turn LDAP on Click on Configure Splunk to use LDAP and map groups Define a new LDAP strategy. In the strategy you can define search filters to have multiple groups. After that you can map the groups to user roles. ... View more

I upgraded from 4.x to 5.0.2 and when I create a new search peer this invalid setting is added. ... View more

each splunk has its own custom extractions, as we are indexing different systems. ... View more

You can point any syslog towards the splunk server and configure the splunk server to receive syslog. So you can point snare to splunk, but you need to configure a receiving port first. Or you can have a splunk forwarder índex the files on the syslog server and send it to splunk. ... View more

I would suggest running: netstat -nat | grep 514 If you know the índex which is receiving the syslog data you can query the metadata: | metadata type=sources índex="yourindeX" ... View more

Correlation is quite difficult, because there is no way to do and efective automatic correlation. So all the correlation will have to be written as custom queries/alarms. If you have and IDS or IPS on the network that will already have signatures for most things you could detect by correlating all other sources you listed. Usually the logs will help incident response team analyze the IDS/IPS alerts. Example correlations: Users login/accessing many different resources (bruteforcing/scanning multiple machines) Users login/accessing from many different locations (credential sharing/compromised accounts) Users login/accessing systems from multiple locations at the same time (credential sharing/compromised accounts) The above correlations will probably only use AD logs. Things like known suspicious source IP accessing systems sucessfully (incoming hostile connection - for example China) and users accessing known suspicious destination IP (outbound data exfiliation and botnet command and control) should already be handled by IDS/Firewall. Another thing to consider is what are you going to do about detection and false positives. I have so far not seen any really useful correlation being done by log managment systems in an automated way, because it is not possible to tell the system what makes sense for your network. Usually you analyze the logs to try and identify things that are not an expected pattern. But maybe someone else has some better correlations working. ... View more

Don't quite understand the problem. Splunk will generate a table and each column has a name. So you getting: result {"TimeStamp":"1364556697.631","id":"58b6bf4d-948b-416b-8d17-cedcbc1059ec","response":{ "start" : 1, "returned" : 1, "count" : 1, "entities" : [ { "houses" : { "callers" : "IM", "placeid" : 5041447014850446107, "number" : 14, "sourceid" : 5625 }, "entitytype" : "house/street", "title" : [ { "default" : "No Place" } ] } ] }} You seem to be getting exactly what you are looking for. If you want to index it, you should consider using a transform to extract the fields. ... View more

It wasn't working for me either. I solved the problem by rewriting the parsing. This might not be the best solution and it might not work for you, because of diferences in the products. Anyway I hope it helps. I first renamed the default/props.conf to default/props.bak and default/transforms.conf to default/transforms.bak. Then I created new props.conf nad transforms.conf in the local directory. props.conf: [opsec] SHOULD_LINEMERGE = false TIME_PREFIX = time= TIME_FORMAT = %d%b%Y %H:%M:%S REPORT-opsec = opsec REPORT-opsec-message = opsec-message transforms.conf: [opsec] REGEX = loc=\d+ filename=\S+ fileid=\d+ time=.\S+ \S+ action=(\S+) orig=(\S+) i\/f_dir=(\S+) i\/f_name=(\S+) has_accounting=\S+ product=(.) __policy_id_tag=.( rule=\d+)?( rule_uid=\S+)?( rule_name=.)?( service_id=\S+)? src=(\S+) s_port=(\S+) dst=(\S+) service=(\S+) proto=(\S+)( message_info=.)?( xlatesrc=\S+ xlatesport=\S+)?( xlatedport=\S+)?( NAT_rulenum=\d+)?( NAT_addtnl_rulenum=\d+)? FORMAT = action::$1 orig::$2 if_dir::$3 if_name::$4 product::$5 src::$6 s_port::$7 dst::$8 service::$9 proto::$10 [opsec-message] REGEX = proto=\S+ message_info=(.*)( xlatesrc=\S+ xlatesport=\S+)?( xlatedport=\S+)? FORMAT = message::$1 ... View more

What kind of file server are we talking about? Windows, Linux or something else? It has to be in the logs for splunk to pick it up, so you need to have an audit somewhere. ... View more

I would say a where would filter out only the events when the memory percentage is above 90: sourcetype=source | rex field=_raw "Java memory percentage: (? .*), OS memory percentage: (? .*)" | rex field=_raw "images was (? .*)" | where java_mem_percent > 90 | stats count However what you might want is actually a rangemap: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap ... View more

You should be looking for: %ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username” %ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”~ Log level has to be set to informational. Event ID is 605004. ... View more

I think these links should help you: http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Indexmulti-lineevents http://splunk-base.splunk.com/apps/72283/splunk-for-oracle-weblogic-server I would suggest: TIME_FORMAT = ^[%Y-%m-%d %H:%M:%S,%3N^] BREAK_ONLY_BEFORE_DATE = true SHOULD_LINEMERGE = true MAX_TIMESTAMP_LOOKAHEAD = 30 I removed the time_prefix because it would skip the regular expression before starting to try and match a date. So to me, your time_prefix doesn't seem correct with your time_format. That BREAK_LINE_BEFORE doesn't seem to be a valid keyword, it should be BREAK_ONLY_BEFORE. ... View more