Assign a search filter to the role. For example, create 3 roles each with access to xyz index but then specify a search filter of source=a on one, source=b on another and source=c on the last. Not the easiest to manage/troubleshoot but should give you the functionality you need if you can't separate the data into multiple indexes. https://docs.splunk.com/Documentation/Splunk/7.2.0/Security/Aboutusersandroles https://docs.splunk.com/Documentation/Splunk/7.2.0/Security/Addandeditroles#Search_filter_format ... View more

what does your whitelist.csv look like? Typically, you would just use the lookup command (not inputlookup) to lookup fields from your events in the table then output something that would indicate it's whitelisted. For example let's say your lookup has two fields: host, service. And maybe your events have fields call host_name and service_name. Then maybe something like this? index=winevents sourcetype="WinEventLog:System" EventCode=7045 | lookup whitelist.csv host AS host_name, service AS service_name OUTPUT host AS found_host | where isnull(found_host) ... View more

Yeah, that's one terrible looking log file. If you have any control over its format, change it to something a bit more splunk-friendly. If not, then maybe something like this below. I didn't test this at all and I'm sure the regex can be better...the examples is just to provide you an idea of how I'd parse it. Essentially, I'd grab the whole thing as one event (at parse time) and then extract the fields i need from each event (at search time). Of course, if the format changes from event to event or is inconsistent in general, then i would have to modify the extractions appropriately. props.conf [your_sourcetype] # PARSE-TIME SETTINGS SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?=Logtime:) TIME_PREFIX = Logtime:\s* TIME_FORMAT = %Y%m%d_%H:%M:%S TIMESTAMP_LOOKAHEAD = 20 # SEARCH-TIME SETTINGS EXTRACT-arrival_time = (?i)ArrivalTime:\s*(?<arrival_time>\S+) EXTRACT-exit_time = (?i)ExitTime:\s*(?<exit_time>\S+) EXTRACT-id = (?i)ID:\s*(?<id>\S+) EXTRACT-max = (?i)Max:\s*(?<max>\S+) EXTRACT-min = (?i)Min:\s*(?<min>\S+) EXTRACT-no1_offset = (?i)^1\s+(?<no1_offset>\S+)\s*(?<no1_direction>counter|reverse)\s*(?<no1_something>\d+) EXTRACT-no2_offset = (?i)^2\s+(?<no2_offset>\S+)\s*(?<no2_direction>counter|reverse)\s*(?<no2_something>\d+) ... View more

what if your remove the spath command from your search? It seems to me like you already have those fields being extracted in some other way, so why do it again with spath? Also, it's important to understand what those settings to as well. KV_MODE happens at search time. Can be set to a handful of values. When set to none, splunk will do not perform search time field extractions on your behalf. It defaults to auto, which will extract = pairs AUTO_KV_JSON happens at search time . It will try to automatically extract json fields from events. Defaults to true INDEXED_EXTRACTIONS configured at input time. Will create indexed fields - meaning, these fields are indexed with the data, not created at search time. Modifying this setting will have no impact on data that has already been ingested into Splunk. My guess is that those fields are being indexed, so they will already exist with your data. And then you use spath in your search, which extracts them again. But it's hard to know for sure w/o knowing what your splunk environment looks like, how you're ingesting the data, etc. And in general, it's probably a good idea to understand the phases of data in Splunk. Even in a one-server environment, knowing which settings apply to which phase and what that means will be extremely helpful ... View more

I think splunk maybe just doing the math exactly as you have typed in the timerchart. Trying wrapping those fields in single quotes. ...| timechart span=1h values(eval('200'*100/Total)) AS 200 ,values(eval('201'*100/Total)) AS 201 ..... ... View more