All, I have three eventtypes [insecure_telnet] app=telnet OR dest_port=23 [insecure_snmp] app=snmp OR dest_port=1234 [insecure_rdp] app=rdp OR dest_port=4321 I'd like the email alert I get to have the protocol I don't trust in the email header. e.g. ALert - insecure Service TELNET detected on HOST Rather than write an alert for each insecure protocol I don't trust I was hoping just to bind all these together like index=os eventtype=insecure_telnet OR eventtype=insecure_snmp I figured I can stats by eventtype, but that doesnt' quite cut it since it includes other eventtypes. Is there maybe a way to use eventstats or a eval to create a field which states the insecure protocol? ... View more

All, First time doing a Python scripted input. For portabability should I be using the local Python on Splunk in my scripted input headers? Or the OS's Python install? #!/opt/splunk/bin/python print "hello world" Or should I point to the specific version as well? #!/opt/splunk/bin/python2.7 print "hello world" ~ ... View more

Hi all, I have a file that looks like this - Added files: added: /etc/addedthisfile added: /etc/cron.daily/tripwire-check added: /etc/tripwire How can field extract added=*? ... View more