can you post what you have in your props.conf for the sourcetype ... View more

@FraserC1 I do believe that this app is datamodel driven. Are your datamodels accelerated? And are they returning data? ... View more

@kaushik_kmk.. Gotcha.. Here is a link regarding all the Splunk API references. https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTprolog Hope this helps ~John ... View more

Try this for lockouts: (sourcetype="WinEventLog:Security" EventCode=4740 src_ip!="127.0.0.1") | stats count by src_ip,user, user_email, dest, subject ... View more

do you have the Splunk_TA_microsoft_ad app installed? Run this command on on of the universal forwarder that is sending the data. .\splunk.exe cmd btool inputs list --debug ... View more

Sorry i edited my comment as you posted.. check SPLUNK_HOME/etc/system/local. If there is an inputs.conf with the stanza's in there ... View more

Are there UF that have the app installed? Also you might want to check SPLUNK_HOME/etc/system/local. If there is an inputs.conf with the stanza's in there. ... View more

@ kaushik_kmk I know this isnt a REST solution. From the license manager you can monitor the roles and status. Settings > Monitoring Console. This query will also tell you the status of the server: index=_internal sourcetype=splunkd group=tcpin_connections hostname=<splunk_servers> | stats max(_time) as last_connected, sum(kb) as sum_kb by guid, hostname | eval connected_last = strftime(last_connected, "%F %T.%3N") | addinfo | eval status = if(isnull(sum_kb) or (sum_kb <= 0) or (last_connected < (info_max_time - 900)), "missing", "active") | table hostname last_connected status ... View more

i don't know if this will make a difference, but your regex is missing escapes on your some of your characters. Try | rex "tid\"\:\"(?<tid1>[^\"]+)" ... View more

something like this? I threw in to only show fields "Cisco_ASA_message_id" since I know ASA is intensive. index=firewall sourcetype="cisco:asa" Cisco_ASA_message_id="3020*" NOT Cisco_ASA_message_id="302010" | fields Cisco_ASA_message_id | eval connection_type = case(Cisco_ASA_message_id==302013 OR Cisco_ASA_message_id==302014,"tcp", Cisco_ASA_message_id==302015 OR Cisco_ASA_message_id==302016,"upd", Cisco_ASA_message_id==302020 OR Cisco_ASA_message_id==302021,"icmp") | timechart count by connection_type ... View more

so basically you want to only send the data to the index based upon that user? ... View more

Try this: Mtime\s\:\s(?<Mtime>\d{4,}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s\,\s\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}) ... View more

You can't. Once the data is indexed, you can't move the data to another index. Why not stand up a syslog server with a UF? Then you can send your syslog data to different directories based upon host and then send them to the peer based upon what the data type is. Network, firewall etc. ... View more

Splunk Base has a nice app for this. Utilization Monitor for Splunk Utilization Monitor for Splunk Also to answer your question fwdType=uf will tell you that it is a Universal Forwarder, ... View more

Ok I found it. You need to edit the password.conf file and change the attribute to False . This is buried in the setup page of the app not the add-on. ... View more

ok, i found my issue. i was using the event hub namespace and not the hub name. ... View more

What i am seeing is 2019-10-15 18:54:47,034 ERROR pid=61165 tid=MainThread file=mgmt_operation.py:on_complete:118 | Failed to complete mgmt operation. Status code: 404 Message: "The messaging entity 'eventhub' could not be found." Which is the hub name. Looking at the input, i'm confused as to what share connection string I should use. I am using the shared connection string in Azure for the event hub it self. I am use to using the tennant ID, Subscription, App and Secret for permissions of other Azure Splunk inputs. This is the connection string that I am using: Endpoint=sb://'eventhub'.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey='secrect' ... View more

I do.. Let me look at the configuration of the input. I will let you know. Thanks! ... View more