I have a scenario where I have a data set that contains user ids, among other things, but there are two possible versions of the user id that I would like to be able to combine into a single search result. For example, user id could be d1\123456 and it could be d2\123456. This is the same user just from a different domain. index="pan" | stats count by user | sort -count This will result in a separate line for every unique user d1\123456 45 d2\123456 83 I would like to be able to get a single line for user 123456 irrespective of the domain (d1 or d2). 123456 128 Is this possible? ... View more

I've been struggling with this for several days now and cannot find a solution that works for me so I am turning to you all. I simply want to exclude 2 files from a directory from being indexed. The two files exist on one of my Linux servers and are in the /var/log/httpd directory along with regular Apache log files that I DO want indexed. The two files to be excluded are 64080_access_log and 64080_error_log. From what I have read, the solution should be to have a blacklist line in the inputs.conf file, which I have done in the /splunk/etc/apps/Splunk_TA_nix/local directory, and it looks like: [monitor:///var/log/httpd] blacklist=64080_access_log|64080_error_log disabled = true But this is not working. After a restart of Splunk, I am still seeing log data from the blacklisted files. In case it's relevant, I have my main Splunk host that receives those logs, and does the indexing, and that is the host I have added the above code to. I also have a heavy forwarder setup as my Universal Forwarder deployment server, but it does not receive or process any log data. Am I right in adding the above code to the main Splunk server that is receiving the log data? Many thanks. ... View more

I have a search table that lists user ids in the form of [domain][userid] and a numeric value. There is a drilldown set on the user id that opens a new search where the user id becomes the search value. The problem is that when the new search opens I have to manually replace the single '\' with '\' so the search will run. Drilldown search looks like this: index="pan" user="$row.user$" | stats count by http_category | sort -count Where $row.user$ is the carried forward value (eg uni\3333333) and is what I have to manually correct to uni\3333333. Is there a way that I can have this manual correction made automatically as part of the drilldown search string. Cheers ... View more

I'm wanting to exclude records with a particular keyword from being ingested by the indexer. I have several Windows servers all pointing to a heavy forwarder where the inputs.conf file determines which logs to ingest into the Splunk indexer however there is some selected content that I want to exclude that exists in some of the included logs. Specifically, I want to exclude any records that contain the word "Zabbix", or "Zabbix Agent". How can this be done and where is the best place to do this filtering? ... View more

I'm wanting to find out if it's possible to take a list of items in a text file, conduct a search against that list and report the number of times each item appears in the Splunk data. For example, I will have list of ALL available firewall policy names in a text file. I would like to be able to use the contents of that file and compare each rule name against the firewall data in a search and show a count of the number of times each entry in the policy file appears in the search data. Thanks in advance. ... View more

I have created a search including sparkline: index=_* type="threat" severity="medium" | stats sparkline count | table sparkline and when it displays, I get the heading "sparkline" above the resultant chart, but I would like to remove that heading so that I only see the sparkline. ... View more

I have a string of data that includes a field named user that has a value made up of domain\userid (eg prod\3245762 or tst\3245762 tst\smith) . I am wanting to write a search that can pull data based on a wildcard for the domain then only detect userid starting with 3,4 or 5). I've tried index=* | rex field=user("*\\[3-5]*") and various versions of. The majority return errors such as "...... is invalid", "Error in Search Operator:regex" Can anyone shed some light on an appropriately formatted regex or rex statement please. ... View more

I have Splunk receiving data from various sources, but I would like to be able to send that data on to another syslog collector. I have read that various documents on how this should be achieved and I have added the following to the outputs.conf [syslog:my_syslog_group] server = 192.168.1.1:514 type = udp Yet the data is not getting sent to that collector. This new collector is actually running on the same host as Splunk, but is using the default syslog port of UDP/514 where as Splunk is using a different port. Firewalls are not causing the problem as I have tested this with the firewalls disabled. What else do I need to do to make this work? ... View more