Try adding | ConvertTo-Json -Compress to your PowerShell command. ... View more

This was moved to March 2020. https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190023 ... View more

Is udp://192.168.110.30:516 the sourcetype for this data? That is what your props.conf indicates. If not, you may need to replace that with something else, such as one of the following: #Sourcetype: [cisco:acs] #Source: [source::udp://192.168.110.30:516] #Host: [host::192.168.110.30] ... View more

You could filter out the source IPs behind your firewall to get incoming traffic. The actual IPs to use will depend on your environment. Here is an example: index=fortigate sourcetype=fgt_traffic host="FGT-200" (dest_port=443 OR dest_port=80) srcip!=203.0.113.0/24 srcip!=192.168.15.0/24 ... View more

You could use ingest-time eval, if you have Splunk 7.2+. https://docs.splunk.com/Documentation/Splunk/latest/Data/IngestEval props.conf: [o365:management:activity] TRANSFORMS = o365index transforms.conf option 1: manually choose index based on Workload field: [o365index] INGEST_EVAL = index=case(match(_raw,"\"Workload\":\s\"AzureActiveDirectory\"}"),"index1",match(_raw,"\"Workload\":\s\"Exchange\"}"),"index2",true(),"index3") transforms.conf option 2: dynamically choose index based on Workload field, index will have same name as Workload (o365:exchange, o365:sharepoint, etc.) [o365index] INGEST_EVAL = index="o365:".lower(replace(_raw,".*?\"Workload\":\s\"([^\"]+).*","\1")) ... View more

Emoji example: | makeresults | eval A="UP" | eval B="DOWN" | eval C="UNKNOWN" | eval D="N/A" | eval E="WARN" | eval F="UP" | fields - _time | replace UP with ✅ | replace DOWN with ⛔️ | replace UNKNOWN with ❔ | replace N/A with ❔ | replace WARN with ⚠️ ... View more

|tstats values(sourcetype) as sourcetypes, values(source) as sources where index=* by index ... View more

You could use a UF on another server as an intermediate forwarder. https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/Configureanintermediateforwarder Another option is to use Windows Event Forwarding (WEF) to send the events to the second server, then have the UF on that server send them to the indexer. ... View more

If it is a single uriPath you are looking at, you can do this: index="<index>" sourcetype="<sourcetype>" URL="<uriPath>" | stats count by srcIP | search count>5 ... View more

You can use Serilog. https://github.com/serilog/serilog-sinks-splunk A Serilog sink that writes events to the Splunk. Supports .NET 4.5+, .NET Core, and platforms compatible with the .NET Platform Standard net45, netstandard1.1, netstandard2.0 ... View more

There is a MobileIron Cloud Splunk app. If you have access to MobileIron's support site, search for "Splunk Enterprise app for MobileIron Cloud User Guide". ... View more

You could possibly do something like this Jamf Graylog Integration using the Splunk Java Logging Appenders. Documentation Example Configs ... View more

IN should be in caps, and you should not need the "| search" in there. index="things" AND sourcetype="user_pixel" AND os="*" page IN ("Contact Us") | timechart span=3hr count by os limit=7 https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Search#Multiple_field-value_comparisons_with_the_IN_operator ... View more

##### Explanation for SEDCMD Extractions ##### ## windows_security_event_formater: This will replace all values like "Account Name:-" to "Account Name:" ##### SEDCMD Extractions ##### #SEDCMD-windows_security_event_formater = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g Source Add to props.conf, remove the # before SEDCMD-windows_security_event_formater. ... View more

It should not require html dashboards. After adding the dashboard.css to your app, you may need to restart Splunk or access https://<yoursplunk>/en-US/_bump and click the button. ... View more

You can change the color of this on all custom dashboards in an app by adding the following to the app's appserver/static/dashboard.css file: .splunk-header.splunk-view.splunk-header.splunk-view > div[data-view="views/shared/appbar/Master"] { background-color: #742255; } ... View more