Hello fellow Splunkers, I am having this problem where i can not get rid of a field that shows up blank with no information in it. I have tried several ways to void out the blank space from the results table but have not had much luck. (I have tried saying that NOT (Account_Name="" OR User_Name="") along with other trys.) Any help or sugestions would be greatly appreachiated. index= "windows" source="wineventlog:security" NOT (Account_Name="NETWORK SERVICE" OR Account_Name="LOCAL SERVICE" OR Account_Name="*$" OR Account_Name="*lid*" OR User_Name="" OR Account_Name="" OR User_Name="lid*" OR User_Name="adm*" OR Account_Name="adm*") EventCode=529 OR EventCode=4625 | rex field=_raw "Account For Which Logon Failed:\W\s+\w+\W\S+\W\W+\S+\W\S+\W\s+\w+\W\w+:\W\W(?<cname>.+?)\W" |rex field=_raw "User Name:(?<cname>.+?)\W"| top limit=0 cname The picture below will show that the fifth field has 45 hits, but no cname field. How do i void this/ get this out of my report? (EDIT) Below is the source event for the blank space that I am trying to void out of my report because it is generating to much data. I thank you so much for all the help you guys are willing to provide. 10/18/2012 12:16:49 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4625 EventType=0 Type=Information ComputerName=Server.com TaskCategory=Logon OpCode=Info RecordNumber=95199445 Keywords=Audit Failure Message=An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: Account Domain: Failure Information: Failure Reason: An Error occured during Logon. Status: 0x80090308 Sub Status: 0x0 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. 10/18/2012 12:16:49 PM ... View more

sourcetype=SidewinderFirewall NOT rule_name="Global__deny_all" srcburb=external dstport=3389 | lookup geo ip as srcip I am trying to create a TABLE using the google application to show a count by srcip and also show the source IP next to it. So in the table I want to have a count, srcip, and the geolocation of that src IP. I am just not 100% sure how to create this type of a table in google app. Everytime i use the 'table' or 'top' function in the application no results are returned. Any suggestions? ... View more

The beginning and the end of the file are often the same, but we changed the data in the middle of the file, how do we get splunk to pick up the event and re-index it? ALTERNITIVE: (Same Question) monitoring of text files that are overwritten and timestamp changes but the files are often the same and-or have the same beginning, end and filename. We would like to force splunk to always re-index the file if it has a new timestamp. (df monitoring of files) ... View more

would inputs.csv be a better way to conduct this type of operation. Say i have 100 hosts comming in from my cmdb everyday and i want to run a report on 65 of thoese hostnames that are dynamic and are not going to be the same two days in a row. Is there a way to take the csv file that is going to be exported daily from my cmdb and then run it against a precreated report in splunk. This way i will not have to change the search query everyday and it will just run at a set time. I have a lookup table that looks like this: It is called host.csv hostname host1 host2 host3 host4 I do not understand why i can not import the information using the UI. I keep on getting this error message:Encountered the following error while trying to save: In handler 'lookup-table-files': File is binary and not gzipped Then when i change it to binary, it says the same thing only though backwards. Does anyone have any suggestions? I am trying to set a lookup table equal to host1 host2 host3 host4 and then when i call the table it will run against all of these hosts. Any help would be helpful. This is the first lookup table i have ever created. ... View more