I have the universal forwarder pushed out to some Apache web servers that are indexing some access logs. I would like to send events that represent status checks to nullQueue so they are not indexed. Seems like a pretty simple task to accomplish, but inspection of the logs confirms the events are still being indexed. Here is my props/transforms on my indexers: Here is a sample event: 10.10.10.10 - - [08/Oct/2018:14:51:33 -0500] "GET /heartbeat_flow HTTP/1.1" 200 7 "-" "-" - - Here is my props/transforms on my indexers: [access_combined] TRANSFORMS-SendHealthChecksToNull = SendHealthChecksToNull1,SendHealthChecksToNull2 [SendHealthChecksToNull1] REGEX = GET (?:\/.*)?\/(?:DateServlet|dateservlet.ashx|ping)\/? HTTP\/1.1 DEST_KEY = queue FORMAT = nullQueue [SendHealthChecksToNull2] REGEX = GET (?:\/secure\/webmon\/monitor.html|\/heartbeat_flow|\/wps\/portal\/dpath\/monitor|\/webmon\/test.html|\/mf_monitor|\/applicationDBcheck.php|\/check.txt) HTTP\/1.1 DEST_KEY = queue FORMAT = nullQueue What am I doing wrong? ... View more

I have sequence of events from a VPN session. The last message in the sequence contains a field for duration of the session and I have constructed a search which accurately calculates the start time. I would like to use the start time and the end time as earliest and latest constraints to search for and display the value of the src_ip field which is found somewhere in the middle of the session. I've tried lots of different things with varying success. In the end, I want a single row that contains the start, end, duration, user, and src_ip fields. Here's what I expected to work. My methodology was to find the last event in the session, calculate the session start time, and then pass those values along with some other fields to another search to pull out the value of the src_ip field. In this particular version of my search, I'm getting errors about the values for earliest and latest, though I'm pretty sure this entire approach is wrong anyway. I realize dashboards allow you to use tokens like this, but it's unclear to me how to use field values outside of a dashboard. index=vpn user=ab12345 Cisco_ASA_message_id=113019 | table index, _time, user, duration | eval earliest=(_time-duration), latest=_time, session_start=strftime(_time-duration,"%Y-%m-%d %H:%M:%S"), session_end=strftime(_time,"%Y-%m-%d %H:%M:%S"), session_duration=tostring(duration,"duration") | table index, user, earliest, latest, session_start, session_end, session_duration | append [search index=$index$ user=$user$ Cisco_ASA_message_id=722051 earliest=$earliest$ latest=$latest$ | table src_ip] ... View more

I just installed v1.0 of this app on ES 7.0.2. When I click on the Geographic map, I noticed that the 'Custom Clusters', 'Heatmap', and 'Custom Single Value' custom visualizations are all missing. The Release Notes say '6.4: Added Custom Visualizations', though it doesn't say which ones, and there's no mention of having to install any other apps. So I'm a bit confused about what exactly the requirements are. If I need to install all of these additional visualizations, shouldn't that be stated in the release notes? ... View more

I installed MLK 3.1.0 yesterday on an ES 7.0.2 SH cluster. The first time I visited the Showcase it displayed OK. But after that initial visit, the Showcase does not appear again. I am using Chrome 65.0.3325.181, and I did clear the browser cache as recommended by a similar post. I've also noticed that the Print and Search icons do not display correctly. See the image below. I only seem to have this problem in Chrome - IE11 seems to be able to navigate back to the Showcase and the icons appear normally. Is anyone else having these problems? ... View more