So you're trying to map to the admin role now then (not power), right? Sorry nothing is standing out to me. I thought maybe your users were in a different OU than your groups, so maybe Splunk couldn't find them. But if they're all in there, that's not the problem. Maybe you should turn on debug logging for the LDAP stuff? It might be a lot to sift through, but could help you identify where the problem is (Server Settings -> Server Logging, search for LDAP and change to debug) ... View more

Ok. Would it be possible to post your authentication and authorize conf files here? Getting rid of any sensitive info of course? ... View more

the lookup is in the app under shcluster/apps/[app]/lookups on your deployer? Have you been able to successfully deploy lookups in other apps in the cluster? Can you deploy another lookup in that app? ... View more

I feel like there's a much better way to do this, but this is what popped into my head. Get a total count of the distinct users. Then filter results to only those that failed. Then do another distinct count of those users based on the version. Then do the percentage match - distinct failed out of distinct total... ... | eventstats dc(userID) num_users | where is_successful=false | stats dc(userID) as num_failed_users by version | eval percent_failed_users = num_failed_users/num_users ... View more

I don't do a lot with subsearch, so no expert here. But I think to the point MuS is making...you can just return your results into the existing rex command. Maybe you can try piping it to where instead. Or can you put your subsearch in before the first pipe? If the goal is to limit your results to DeviceNames from the subsearch, that should work right? keeping in mind that I think that subsearch will return something like "(DeviceName="somedevice1" OR DeviceName="somedevice2" OR ...) So maybe either ... | where [source=.....] | sort - _time ... OR source="File1.csv" index="inventory-legacy" [source= ....] | regex Notes="^Succ.*" | .... ... View more

Do you have the userBaseDN configured? Are your users within that base DN? ... View more

with regards to the last paragraph, for both the outputs and deployment client settings, we have apps on the deployment server to configure those settings. When we install a forwarder, we manually copy those apps down to the forwarder (under etc/apps). So when it starts for the first time it knows where to send logs and who the deployment server is. We then deploy those same apps back down to the forwarder from the deployment server. So when all is said and done, nothing is or ever was in system/local and we manage those setting from the deployment server. ... View more

Not exactly what you're asking, but you can use \n to represent a previously captured group in the same rex command. So in your case, something like rex "<tag1>(?P<NamedField1>[^<]+").+<tag2>\1</tag2><tag3>(?P<NamedField2>)" Although I'm pretty sure i found a way to substitute field names in the rex too, but don't remember and could be mistaken. ... View more

Have you tried adding an asterisk to the vendor_mac values in your lookup file? Like this... 000000*,XEROX CORPORATION ... View more

tstats might be a faster option as well | tstats latest(_time) as last where sourcetype=whatever | convert ctime(last) ... View more

The Splunk logs from that sever should be in Splunk: index=_internal host=Server1 sourcetype=splunkd You can obviously sift through the results, maybe searching for "error" or "monitor" or "tailing" (don't recall off hand the best search to find these kinds of problems). Did you ever get logs from Path 2 into Splunk? If not, it might be worth posting your inputs on here to see if something may be off there. ... View more

It all depends on the data you want to bring in. On those 60 forwarders, do you know what logs you're looking to ingest? Can you do some manual calculations to determine how much per day that would be. Will each forwarder report the same type of data? Meaning, can you install on one and extrapolate from there? Are you bringing in anything today that you don't need? Maybe something being ingested by default by the apps you installed? The documentation is worth a read. But at a high-level, if you go over your license for a day then you get a warning. If you get 5 warnings in a rolling 30 day period then you're in violation. At that point, you won't be able to search your data, however it will still be indexed. You would need to request a reset key to remove the warnings and start - something you'd get from your sales contact or support. ... View more

I'm not sure exactly what you're asking either. I've used this below to use the value of a capture group later on in the rex, where "\1" is the value from the first capture group - in this case the malware_domain field. And I have to believe there is a way to escape field values as well is needed (would need to read up on rex), but maybe not. rex "CEF.+rewrite (?<malware_domain>\S+).+(\1|nsdname)\.(?<apt_policy>[^\"]+)" ... View more

Not knowing your role, just a quick note.... maybe you're not searching the desired indexes by default, so you can add index=* to your base search too. If you're literally not getting any results at all and you expect at least something, then that might be the issue. ... View more

You might want to use tstats for that....something like | tstats count where index=blah (host=somehost OR host=someotherhost OR host=something*) by sourcetype ... View more

I don't know if there any official best practices here, but I can share what we try to do. We have two clusters and a few standalone boxes. Some of our apps/TAs/etc need to be on all of those search heads. Right now, our approach is a manual effort. We have a central location on our network where we store "gold" version of apps. And then we copy them down to shcluster/apps or etc/apps on whatever cluster/boxes need them. It's just a process. Need to update an app? Grab the gold copy and put it down on a test box. Make/test your changes. Copy back up to the central repository. Copy down to all of the relevant server. Schedule any needed cluster pushes. You may be able to manage them with a deployment server, similar to how you can for a cluster master? Maybe? (http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations#Use_deployment_server_to_distribute_the_apps_to_the_master). But for now, that's a bit overkill for our needs. ... View more

If you're asking about the receiving port for the heavy forwarder, check inputs.conf. But since you set it in the GUI, it will likely be in one of your apps - like launcher or search etc. It won't be in system/local. For your config, I would think everything would only be getting sent to the syslog server, so I'm obviously no help there. I'm working on a similar project and have been struggling with routing from a heavy forwarder, so a lot to learn yet there for me. But I do have a ticket open with Splunk so if I gain a better understanding and can apply here as well, I'll follow at that time. ... View more

if the paths are the same, then this might work. But hardcoding the case statements for 4 servers isn't too bad either. The idea would be to grab the host part of the Host_FileSystem field. Then change your case to match on the path minus the host info. Then depending on which path matches, either /data or /root to the host we grabbed earlier. But in general, there are probably a few different ways to tackles something like this. And the better you understand the data, the more options you'll likely have. Again, not tested at all... index="tablet_os" sourcetype="df" host=dc1* sda3 OR Data | multikv fields FileSystem, UsePct | strcat host '@' Filesystem Host_FileSystem | rex field=Host_FileSystem "(?<path_host>[^/]+)" | eval Host_FileSystem = case(match(Host_FileSystem,"dev/mapper/localraid-Data"),path_host."/data",match(Host_FileSystem,"dev/sda3"),path_host."/root",1=1,Host_FileSystem) | timechart span=60m avg(UsePct) by Host_FileSystem | rename avg(UsePct) as %Use ... View more

Ok, you only mentioned those two initially. It's kind of hard to give you a better idea of how to make a similar change for everything without seeing all of your data. Are the short forms available anywhere in your events or are they just something you know them as? Do you have an exhaustive list of mappings long names to short names? Or is there a pattern that can be applied to the long names to come up with the short names? We're flying kinda blind here 🙂 ... View more

Yes, we did include that flag when applying the bundle - both during the original upgrade and when we went to 3.3.1. We don't use it in general though for the ES cluster and had never seen it before we read the upgrade docs. ... View more