Not sure about licensing, but I think that could be really mean to do to your indexer cluster. ES runs lots of searches, dm acceleration, etc - doubling those up could be a burden on your indexers (maybe not, depends on env). What exactly is the requirement? ... View more

I mean, it will work where it is - just as long as you know it's there. For example, if you wanted to migrate this app to another hf or something. Just be aware it's not in the rapid7 TA. Or you could move it to the local folder in the TA as well. Really up to you and how you want to manage that hf. ... View more

Glad it's working for you now! Keep in mind, when you go to settings->data inputs, the input you create will be in the app you launched it from. So for example, in this case, I'm guessing you were in the Search & Reporting app when you navigated to the inputs page to create the R7 input. ... View more

if you look in the example conf file at the bottom of that page, specifically at the wql settings, you should see how to query wmi. For example: [WMI:LocalPhysicalDisk] interval = 1 wql = select Name, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk disabled = 0 index = wmi_perfmon If you need to know where in WMI to find the data you want, that's probably going to be all google. For example, the win32_computersystem class has a field for TotalPhysicalMemory. And the win32_physicalmemory class has a field called capacity. I guess another option is to see if the add-on for windows would work for you too. Maybe that would be easier? ... View more

Yes, I believe you would make those changes in indexes.conf. If you want to apply settings to all of your indexes, then you can put those settings in the default stanza. If you need to alter any of those default settings, you can put them in the stanza for the individual index - these settings will win over the default settings. But like esix mentions, where you put your indexes.conf file(s) is really up to you. Yes, it needs to be on your indexers. And yes, how you get it there depends on whether you have an indexer cluster or just standalone indexers. But generally speaking, for any conf files, it's important to understand the order of precedence. You can have the same conf file in multiple places with conflicting settings - but if you know the precedence, you should be good. So yes, you can put the setting etc/system/local. Or you can create your own app like esix mentioned and put your indexes.conf in there. We, for example, have one app where all of our indexes are defined. ... View more

I didn't work on it here and haven't looked at the instructions lately but we were able to get data. Do you have any config for rapid7 in any of your inputs.conf files? Is that still all you see in the TA-rapid7_nexpose logs? you don't see any entries like this? 2017-04-26 09:28:01,819 INFO nx_logger:38 - Setting sites 2017-04-26 09:28:01,819 INFO nx_logger:38 - Connecting Nexpose client 2017-04-26 09:28:02,457 INFO nx_logger:38 - Querying all sites. Side note: if you want to use the index they define, then you will need to create it on your indexers - having it just on the hf won't help. Or, if you want this data in another index, specify it in your inputs (if you can find them) ... View more

ah ok. I have a windows machine in front of me now and see it's not there. I'd say give niketnilay's answer a shot. ... View more

you could also add another column for the total instead of using addcoltotals. ... | eventstats sum(Col2) as Summary It might also be possible to put the total in the panel title? Maybe? ... View more

do you have that config on a heavy forwarder or indexer? don't believe syslog processing is available on universal forwarder. ... View more

I could be mistaken, but I think the user would need to have access to whatever objects they're trying to access via rest. For example, can your power user log on to that Splunk instance and get to Forwarder Management manually (looks like you're trying to hit the deployment server)? ... View more

Something like this maybe? <form> <label>Playing Around</label> <fieldset submitButton="true"> <input type="dropdown" token="t_use_time" searchWhenChanged="true"> <label>Found Time</label> <fieldForLabel>show_time</fieldForLabel> <fieldForValue>use_time</fieldForValue> <selectFirstChoice>true</selectFirstChoice> <search> <query>| tstats latest(_time) as last where index=_internal | eval use_time = relative_time(last,"-4h") | eval show_time = strftime(use_time,"%D %H:%M:%S")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <eval token="form.t_time.earliest">$value$</eval> <eval token="form.t_time.latest">relative_time($value$,"+1m")</eval> </change> </input> <input type="time" token="t_time" searchWhenChanged="true" depends="my_earliest"> <label>Choose Time:</label> <default> <earliest>-1h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <title>Test</title> <search> <query>| tstats count where index=_internal by sourcetype</query> <earliest>$t_time.earliest$</earliest> <latest>$t_time.latest$</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> The dropdown is simple search to get a "peak" time. When that dropdown changes, it sets the earliest/latest values of the timepicker accordingly - earliest is the value of the dropdown, latest is the value in the dropdown + 1 minute. Then the panel uses the timepicker's earliest/latest value. ... View more

why do I need a noop? It seems to work as is for me (6.6.x on laptop)...haven't used noop for a bit, but maybe I should start again? Does the subsearch resolve multi value fields like separate events ? ... View more

Not sure if it's this simple, but that setting is plural: frozenTimePeriodInSecs ... View more

There are probably a bunch of ways to do this. You could use a subsearch to find all of the domains_accessed that were not storage and add those to filter your main search for current storage categories. Or you could probably use join to combine results from todays data with last months data on the domains_accessed field - similar to a sql join. But typically, if you can avoid subsearches and joins, then you probably should. And so I think you can get away with stats here. index=some_access_logs | stats latest(domain_category) as current_category, earliest(domain_category) as first_category by domain_accessed | where current_category="Storage" AND first_category!="Storage" So if you run that over a few months, it should provide you the domains_accessed that was not storage at the beginning of the period but is now. It won't tell you when it switched, not sure if that's needed? I know you say never previously Storage...but not sure when "previously" starts? If it matters when exactly it became storage, that's probably doable with stats too. Hope this helps. ... View more

dumb comment...have you cleared you browser cache? I know we ran into some funky browser problems when going from 6.3 to 6.5. I think the web_service log is where you want to look - may be a bit more information in there. And I'm not sure if that component can log more, but here is the docs for enabling debug logging. ... View more

do you know how you are collecting event log data? I don't have windows data in front of me at the moment, but if the forwarder is configured to ingest event log data, you should have more in the event than your top screenshot. Not sure if you are actually searching the logs in Splunk or maybe just using a dashboard that was made available to you? ... View more

You should be able to use wmi.conf to query whatever WMI classes you'd like (win32_computersystem, win32_operatingsystem, etc). ... View more

I am not a linux admin by any means, but I would look at your ulimits for the Splunk user that's running the forwarder. Maybe the scripts are finishing fast enough and your number of processes is growing until you hit those limits? Just a thought. ... View more

You could create an alert that runs a script with either the deprecated approach or the new approach. I don't believe you can pass arguments directly to that script. But if your arguments are in the search results, parse them out in the alert script and then call the actual script from there. Or if you don't need/want to call the script based on some alert trigger, you could use spunk's rest api to just run a search, then parse the results, then call your script Not sure if any of that helps, but hopefully at least points you in the right direction. ... View more

I would lean toward option 1. If your dev env is locked down to just admins or you have appropriate roles defined on the dev search heads so users can't search what they shouldn't be allowed to search on your prod indexers, that seems like it should be ok. And I would probably just run it on a standalone search head. We don't have ITSI, and I imagine supporting it in a cluster is a little more challenging than on a standalone (like Enterprise Security is), but typically a POC is more about what the app can do and less about how it needs to be supported. And if you have temporary license, you probably want to spend as much time in the app as possible...instead of troubleshooting a shc ... View more

can you share your dashboard xml here? And maybe describe what you're trying to accomplish? It might be easier for us to help if we see how you are defining these tokens and what they represent. Typically, I think you would have the label of your dropdown be what the user sees and then the value of the dropdown be what you want to use in your search. But I'm not quite sure what text_name is or represents here, so not really sure where that comes into play. ... View more

I can't answer whether there is a need for them, but others do filter out these computer accounts: https://answers.splunk.com/answers/303882/unable-to-blacklist-windows-events-with-regex-on-u.html ... View more