If your forwarders are version 6 or above, you can use the Windows event filtering, which would prevent sending the data to the indexers in the first place. More info: http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/ https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html#answer-152132 I feel like this would be a more effective way of accomplishing the same goal, if you are trying to filter based on the event code. Edit: This can also be used to filter based on information within the Windows event. ... View more

Yes, the two can run side-by-side. The problem would be if you had both running the same set of inputs. ... View more

Accelerated Data Models are like summary indexes. That is, they will contain bits and pieces from events (the fields from the events that the data model includes) but they do not contain the the original event, nor pointers to them. You are correct, unlike Splunk's normal late-binding schema, data models are a little more rigid, and as such can offer speed when reporting. Typically, when attempting to drill down from the accelerated data to actual events, the root search for the data model is used and combined with the other information from the accelerated fields, and the time range to get to the original event. However, this is running a new search to pull the event data (and possibly multiple events) based on the summary data, not "this is the event that relates to the accelerated data". I hope that makes sense. It's important to remember that accelerated data models are summaries, and as such a single accelerated entry in the data model should point to more than one event. If you make the data model too specific, you end up with a bloated data model that will take up a lot of space (the data model included with the Palo Alto app is an example of this, as it includes very specific fields like an ID with each event, you end up with a very large accelerated store). For information on where data model accelerations are stored, you can check out the Knowledge Manager Manual. For a custom data model, it's harder to say what the usage might look like, but for the models include in the Common Information Model App, you can take a look at this page in the knowledge manager manual as well as the Deployment Planning section of the ES documentation. HTH ... View more

Hey napoleon, Sorry for the delay (vacations happen). I've tested on 6.4.1 and have updated the splunkbase listing to reflect that is compatible. Thanks! Dave ... View more

From our slack chat: We usually create a set of different apps, one for each EventLog branch we want. So: DS-all_department-Input-windows_security DS-all_department-Input-windows_application DS-all_department-Input-windows_system And so on. Then there would be ones for files, like DHCP, DNS, update log and another for scripts. You can then use the serverclasses to mix and match as needed. Atomic apps to create molecular configs. ... View more

Your extracts need to have different names, and you should use named capture groups, like so: [mysourcetype] EXTRACT-user0=^(?:[^\-\n]*\-){4}\d+>\s+<\w+\s+(?<user>[^ ]+) EXTRACT-user1=user:(?<user>\S+)(\s|\>) EXTRACT-user2=username\s(?<user>\S+)> EXTRACT-action0=\swas\s(?<action>login)\s EXTRACT-action1=\<(?<action>\S+)\ss EXTRACT-action2=\](?<action>\S+)\sJoined HTH, Dave ... View more

This is my fault. When I updated the URL in the README, I didn't update it in the Splunkbase documentation. The correct URL should be: http://browscap.org/stream?q=BrowsCapCSV So the correct command is: wget -O browscap.csv http://browscap.org/stream?q=BrowsCapCSV ... View more

You can try adding something like this to the end of your search: | lookup malware_domainsdm.csv domain AS reformattedDomain | search category=* which would perform the lookup against the downloaded list, using the reformattedDomain as the key against the values in the domain field. Then the search command filters the results to only show the items for which the lookup was successful. You may not want the stats portion of the search you have in your search. HTH, Dave ... View more