Hello, All data ingested to Splunk are saved in the index at the same location you are accessing above (default path for indexes, and it can be changed). The index is a proprietary data store created by Splunk and it consists of raw files which are not supposed to viewed by a text editor, however if you grep certain log lines you will get the corresponding bucket. For example: grep -R 'port=49872' /opt/splunk/var/lib/splunk//* For more details have a look to this question: https://answers.splunk.com/answers/6467/what-is-splunk-database-engine.html Regards ... View more

Hello, I suspect the Alert mode parameter in Alert definition, it could be: Once per search or Once per result . Set it to Once per search and check the behavior, you can do from Web interface or from savedsearches.conf : alert.digest_mode = True Regards ... View more

Hello, OPSEC LEA app consist of 2 parts, data collection part and knowledge objects part. Data collection part is a scripted input, that contains wrapper python scripts that invokes the loggrabber binary that pulls logs from Checkpoint management server, then you can forward logs to any destination which is indexers in case of Splunk cluster. So the best practices is to install the app on heavy forwarders (as python is required) for data collection. And it should be installed on search heads to have knowledge objects (lookups, aliases, field extraction) Have a look to this doc for more details: http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install Regards ... View more

Hello, Nice use case, you can achieve this by defining a CSV lookup. The CSV file will have 2 columns, the first one is member name and the second one is Membership status, something like that: user, membership_status User1,Yes User2,Yes User3,Yes User4,Yes Your events should include the user filed (first coulmn header). Define the lookup in in transforms.conf [Team_Members_lookup] filename = team_members.csv default_match = No CSV file location: /lookups/team_members.csv You search query can be like this: sourcetype=winlogs | lookup Team_Members_lookup user OUTPUT membership_status | search dest_machine=Serv123 membership_status=No This lookup enriches the logs with a new field membership_status, its value will be "Yes" if the user is on the csv file otherwise it will be "No" You can add the lookup to props.conf to be applied automatically on a certain sourcetype, and in this case you don't need to put "lookup Team_Members_lookup user OUTPUT membership_status" in your query, but it may have some performance impact as the lookup is applied in all searches. Regards ... View more