All, I have logs coming in from /var/log/messages and /var/log/maillog which have the hostname not the FQDN. There is just too much change control and politics to get them fixed at the source. Looking for a way at index time to just make the correction. Server names are well formed 12 characters ending in three numbers. So I need to create a props.conf/transforms.conf on my indexer, just not sure what it will look like. If host = .*\n\n\n then append mycompany.com Any ideas what that might look like? ... View more

All, I have a list of PCI hosts. Now what I want to do is take that list of hosts and create a report/alert to display hosts which are not reporting /var/log/secure. Any idea how I might do this from a search? ... View more

All, Just day dreaming here a little as I read the indexes.conf file documentation a bit. I was thinking, assuming you're willing to risk the data loss wouldn't it make sense to house your Hot buckets to a RAM disk, then roll from HOT to warm to actual disk? Crazy? https://www.jamescoyle.net/how-to/943-create-a-ram-disk-in-linux ... View more

All, Is there any value or having cold storage for my indexes if I am using the same disk? Why not leave everything in warm storage? ... View more

All, I just had a user want to compare lists/arrays for diff etc. Honestly I have no idea how I might compare mvfields or even events. Wondering if you can point me to a good tutorial/doc on this? SOME USER [2:10 PM] ---- [2:10] does Splunk have any way to compare lists/arrays? [2:11] I have delimited list A and list B [2:11] is there a splunk function to diff the two? [2:11] (or alternatively, split list A and list B, load them into two mvindex-ed fields, and compare the two fields for diffs) [2:12] My Use Case: Windows logs changes to AD Group memberships, but doesn't actually tell you WAHT change was made [2:13] so I want to compare Event 1 "Here are the current group members" to Event 2's "Here are the current group members" and find what changed ... View more

All, We have a lot of key value pairs using single quotes. I am THINKING there is a way to fix this using SEDCMD. But honeslty I don't see how. Any ideas? I can do them as one offs pretty easy, but I'd rather just have one SEDCMD for it all. myvariable='wedfwerfwe' would be myvariable="wedfwerfwe" ... View more

All, Is there a way to get a report to run on a specific member of a search head cluster? Mainly I want to know for sure which member has the outputcsv. thanks -Daniel ... View more

All, When I search and use rex I get the ports from the Apache logs as expected. Getting all ports 80 and 443 and 8080. index=web 443 | rex field=_raw "^\d+.\d+.\d+.\d+ - (?\d+) [" How ever, when I place the same extraction in props.conf it only gets port 80 [apache:access] EXTRACT-port = ^\d+.\d+.\d+.\d+ - (?\d+) [ Any idea where my mistake is? ... View more

All, I have the following config in my indexes.conf ### define volumes [volume:splunklocal] path = /splunk_data maxVolumeDataSizeMB = 600000 ... [akamai] repFactor=auto homePath = volume:splunklocal/akamai/db coldPath = volume:splunklocal/akamai/colddb thawedPath = $SPLUNK_DB/akamai/thaweddb frozenTimePeriodInSecs = 7776000 The volume splunklocal is 600gigs. When this maxes out I was hoping to roll older logs to another volume called splunkbrozestorage. Is this possible? That is to say, I am not hitting my 90 days policy. I am hitting the volume size limitation. So I installed another volume of disks to roll to. Any ideas? Docs? ... View more

All, Is there a way for me to append data to an event at the UF level ? Or perhaps at index time ? I want to prepopulate some business details. I was also asked recently to autoappend geoip info into the events if possible. Any ideas? ... View more

All, Is there a way to route traffic based on host AND sourcetype? if sourcetype="abc" AND host="zxc" then index=compliance if sourcetype="abc" and NOT host=zbx then index=web ... View more

All, I have 10 servers that are end of life. So I am replacing them with 10 new ones. I stood the new ones up as an index cluster and things went well. I sorta assumed I could copy the data from each indexer, reboot and the cluster woudl pick it up. This does not seem to be the case as I am getting the message below. 08-15-2017 18:11:34.645 +0000 WARN CMSlave - Failed to register with cluster master reason: failed method=POST path=/services/cluster/master/peers/?output_mode=json master=mymasterserver.mydomain.com:8089 rv=0 gotConnectionError=0 gotUnexpectedStatusCode=1 actual_response_code=500 expected_response_code=2xx status_line="Internal Server Error" socket_error="No error" remote_error=Cannot add peer=X.x.x.x mgmtport=8089 (reason: bucket already added as clustered, peer attempted to add again as standalone. guid=FAF83722-06AA-4085-BB7A-750447C6FEF9 bid= _telemetry~1~FAF83722-06AA-4085-BB7A-750447C6FEF9). Make sure pass4SymmKey is matching if the peer is running well. [ event=addPeer status=retrying AddPeerRequest: { _id= active_bundle_id=0EC2D631C0BA7AB84B04E88C8E7B437B add_type=Initial-Add base_generation_id=0 batch_serialno=1 batch_size=1 forwarderdata_rcv_port=9997 forwarderdata_use_ssl=0 last_complete_generation_id=0 latest_bundle_id=0EC2D631C0BA7AB84B04E88C8E7B437B mgmt_port=8089 name=FAF83722-06AA-4085-BB7A-750447C6FEF9 register_forwarder_address= register_replication_address= register_search_address= replication_port=8080 replication_use_ssl=0 replications= server_name=myserver.mydomain.com site=default splunk_version=6.6.0 splunkd_build_number=4b804538c686 status=Up } ]. Can someone point me to the correct procedure here? thanks, -Daniel ... View more

All, Any rough number estimates on the Splunk app for Qualys' gigs/day usage? Anyone familiar with this app give me any input? Our security team is pushing for it but I need to justify value for disk/license. thanks -Daniel ... View more

All, We are a user of Puppet and it's PuppetDB service. Which is a great place to get system information. I can from the command line pull custome infomation ("facts") with this command Command Used: /usr/bin/curl --silent -X GET http://puppetdblvsp.somecompany.com:8080/v3/facts --data-urlencode 'query=["=", "name","ipaddress"]' | sed ':a;N;$!ba;s/\n/ /g' | sed 's#}, {#\n#g'| awk -F '"' '{ printf "%-30s*%-30s\n", $12, $4}' | sort -n -t* -k 1 | tr '' ' ' | sed 's/[ ]$//' | grep -E 'log' When run it returns a nice CSV of the data I want. I looked over the guides to creating a custom command and it went over my head with all the Python. I am guessing Bash is supported? Any one have a walk through on getting started with this? thanks ... View more

All, Often times I just want to see the delta, not the sum of a timechart. Any ideas on if there is a way have Splunk automatically zero in on the areas of interest for the Y axis? Example - ... View more

All, Anyone have a walk through on how I might install various threatlists to Splunk ES in a search head configuration? I can assume I just download the files to the search head deployer, just not sure where in the path I place them. thanks ... View more

All, Might just be lack of caffeine here. But I can't quite get this subsearch working. I have my assets.csv setup for Splunk Enterprise Security (ES) - dest_requires_av=True I can see hosts checking in with with malware logs with tag=malware How can I made a dashboard that basically says "If AV (AntiVirus) is required, and no AV logs are found, list hosts in a table" Something like |inputlookup assets.csv | [my subsearch] | table myhosts... ... View more

All, I am reading in a CSV daily into index=main. It will have about 100k items in it. I want an alert for any added, removed file_name. OR an MD5 has changed. I have them brought in as their own event each. CSV format is easy - file_name, md5_hash Looking for a snappy search to compare these files? Any samples or commands or advice? ... View more

All, Can you recommend a simple/cheap/Splunk friendly FIM for Windows systems? Ideally something with an app ready to go? thanks -Daniel ... View more