hi, I am trying to combine results into two categories based of an eval statement. The original query returns the results fine, but is slow because of large amount of results and extended time frame: index=enc sourcetype=enc type=trace source=*123456*| eval Call = if(app_type="API", "sdk", "non-sdk") | stats count by Call I tried the following with tstats , but none of them work, meaning displayed 0 results. | tstats count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 Enc.app_type=* | `drop_dm_object_name("Enc")` | eval Call=if(app_type=="API", "sdk","non-sdk") | stats sum(count) by Call AND | tstats count from datamodel=Enc where sourcetype=enc-trace Enc.type=TRACE Enc.cid=1234567 | `drop_dm_object_name("Enc")` | eval sdk=if(app_type="API",count,0), non-sdk=if(app_type!="API",count,0) | stats sum(sdk) as SDK, sum(non-sdk) as NON-SDK appreciate help and ideas from Splunkers. Thanks ... View more

We have application writing logs as Windows Events . There are 3 fields that we wanted to mask .. Accept-Language=en-US,en;q=0.9 Authorization=Auth xcvftYUIOLKN2luc3QiOiJiZTExMTQwODkzIiwiZWxsaV91aWQiOiJFbmNvbXBhc3NcXGJlMTExNDA4OTNcXDU5NTg0NjI4NTQiLCAic2Vzc2lvbiI6ImJlMTExNDA4OTNfMjhiZTI3NTYtZjY3MC00NGVhLTk4MzktMmM2NTRmMzkzZDc4IiwgInNpdGVfaWQiOiIzNjUxMzEzMzcxIiwgImluaXRfa2V5IjoiIn0= Host=enc-ez9.xzapi.com Referer=https://portal.juniorkiio.com/site-app/?id=1234567 User-Agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 base-URI=/reverseproxy Enc-Session=cte235467_28be2756-f670-44ea-9839-2c654f393d78 http-method=GET We want to mask values of Authorization, Referer and Enc-Session. I have tried masking one to see, if it works but haven't seen any success. Following is my props.conf [es_prd_api] TRANSFORMS-anonymize = authorization-anonymizer transforms.conf [authorization-anonymizer] REGEX = (?m)^(.*)Authorization=(.*)$ FORMAT = $1Authorization=########$2 DEST_KEY = Message Appreciate help and guidance. Thanks ... View more

Trying to blacklist specific windows event logs based on event code and task category, but doesn't work . [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 index = winevents renderXml=false blacklist1=EventCode="5145" TaskCategory="(Detailed File Share|File Share)" Example event - 07/13/2018 11:22:01 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=5140 EventType=0 Type=Information ComputerName=SomeServer TaskCategory=File Share OpCode=Info RecordNumber=5487448804 Keywords=Audit Success Message=A network share object was accessed. Subject: Security ID: S-1-5-21-xxxxxxxxx-xxxxxx-xxxxxx-xxxx Account Name: cz9_rmc_s3_CIFS$ Account Domain: domain Logon ID: 0x3D9AC95C1 Network Information: Object Type: File Source Address: 10.xxx.xx.xxx Source Port: 45088 Share Information: Share Name: \\*\IPC$ Share Path: Access Request Information: Access Mask: 0x1 Accesses: ReadData (or ListDirectory) ... View more

Need help to extract timestamp and structure data - {"time":"2017-12-12 16:25:27.418 +05:30", "severity":"INFORMATION", "_tag":"", "correlation_id":"null","Message":"[RequestController] RequestController - POST - api/request - [STARTS]", "client_id":"null", "instance_id":"null", "class_name_hierrarchy":"","method":"", "response_time":""} {"time":"2017-12-12 16:25:27.418 +05:30", "severity":"INFORMATION", "_tag":"", "correlation_id":"null","Message":"[EPCAdapter] - CreateRequest - Before Get OAuthToken - ", "client_id":"null", "instance_id":"null", "class_name_hierrarchy":"","method":"", "response_time":""} {"time":"2017-12-12 16:25:27.418 +05:30", "severity":"INFORMATION", "_tag":"", "correlation_id":"null","Message":"[HttpCommunicationHelper] In Execute Request Method", "client_id":"null", "instance_id":"null", "class_name_hierrarchy":"","method":"", "response_time":""} {"time":"2017-12-12 16:25:27.418 +05:30", "severity":"INFORMATION", "_tag":"", "correlation_id":"null","Message":"[HttpCommunicationHelper] Request Type is POST", "client_id":"null", "instance_id":"null", "class_name_hierrarchy":"","method":"", "response_time":""} {"time":"2017-12-12 16:25:27.418 +05:30", "severity":"INFORMATION", "_tag":"", "correlation_id":"null","Message":"[HttpCommunicationHelper] Request Base URL is https://int.api.ellielabs.com/", "client_id":"null", "instance_id":"null", "class_name_hierrarchy":"","method":"", "response_time":""} ... View more