Hi. I have configured a 6.5.3 Linux Universal Forwarder with an inputs.conf like this: [monitor:///www/*/logs/access_log*] disabled = 0 index = web sourcetype = access_combined crcSalt = <SOURCE> blacklist = \.gz$|lost\+found I am trying to blacklist a directory named '/www/lost+found' because the splunk user does not have read-permission to this directory. But the blacklist regex isn't working because I am still seeing a WARN FilesystemChangeWatcher - error reading directory "/www/lost+found": Permission denied error in the _internal log. It seems to be ignoring .gz files as I would expect. Is this an issue with the regex? Or is this more of an order-of-operations type of situation where it needs to read the directory before processing the blacklist? ... View more

First let me say I'm no Active Directory expert so maybe this behavior is expected. But I have successfully installed the Splunk Supporting Add-on for Active Directory and tested the connection. When I run a simple search, there's a relatively long (~10s) delay before the results are returned. Here's what my search looks like: | ldapsearch domain=ACME search="(&(objectClass=user)(samAccountName=george))" attrs="department" The search takes about 9 seconds, which seemed strange to me so I took a packet capture. After the bind, it looks like the add-on is sending a subSchema search for 12 attributes. A couple of those attributes (dITContentRules and attributeTypes) have a lot of values - 647 and 4108 respectively. It's the transmission of these attribute values that is causing the search to take so long. Once the add-in sends the actual search based on my search term, the response is almost immediate. Is it normal for the add-on to send that initial subSchema query? Is there some reason it's necessary, or some way to suppress it? ... View more

I am kicking the tires of the Splunk Stream app v7.10 on my v6.5.3 distributed deployment. I want this data to go into an index named 'sandbox' which is only available on my Indexer. But when I create a new stream and am at the point where I must select an index, the only indexes I see are the ones on the SH. Did I mis-configure something? ... View more

I'm a fairly inexperience Splunk admin, and I've used the Add Data feature a couple of times to test out new sourcetype properties. At the moment, I'm trying to develop a custom syslog sourcetype and apply it to a network input but I'm having a lot of difficulty with line breaking. The sample data I'm using was gathered by a packet capture, exported as raw data, and added to a text file. It seem to get it working with the sample data, but when I apply it to the actual input, I run into all sorts of issues. This got me thinking...the syslog events in the input stream do not actually end with a CR/LF character. But every event my sample data that I'm ingesting is on a new line. Is this an inaccurate way to represent the sample data? Would it be a more accurate representation of the input stream if I concatenated these test events onto a single line in my sample text file and tried to line-break from there? ... View more

Hi. I need to add no_priority_stripping = true to my UDP syslog input so that I can create a lookup for the facility and priority fields. But when I do this, line breaking doesn't work properly. What I'd like to do is LINE_BREAKER = (<\d+>), but of course, this strips out the characters that I need for the lookup. How do I configure this input to break on that regex, but retain those characters in the event? Here are some sample events: <85>Mar 21 13:16:22 C220-FCH1922V34X AUDIT[17179]: Login success (user:iseadmin, ip:192.168.10.10, service:sshd) <85>Mar 21 13:16:22 C220-FCH1922V34X AUDIT[17179]: Session open (user:iseadmin, ip:192.168.10.10, id:63, type:CLI) <85>Mar 21 13:16:53 C220-FCH1922V34X AUDIT[17180]: Session close (user:iseadmin, ip:192.168.10.10, id:63, type:CLI) My goal is to lookup for the value 85 and return two new fields. And this will work, if I can get the lines to break as I described above: syslog_facility=authpriv syslog_severity=notice ... View more

Hi. I'm trying to set up the Cisco ACI Add-on for Splunk Enterprise v4.0 on Splunk Enterprise 6.5.1, and am getting connection errors in splunkd.log similar to this: 03-02-2017 11:34:46.679 -0600 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_cisco-ACI/bin/collect.py -health fvTenant fvAp fvEPg fvAEPg fvBD vzFilter vzEntry vzBrCP fvCtx l3extOut fabricHealthTotal fabricNode eqptcapacityPolEntry5min eqptFabP eqptLeafP eqptCh eqptLC eqptFt eqptPsu eqptSupC ethpmPhysIf" Could not relogin to APIC due to ConnectionError When I run the collect.py script from the command line, I get this: splunk@server:[~/etc/apps/TA_cisco-ACI/bin]> /opt/splunk/bin/splunk cmd python collect.py ACI Error: Did not receive a session key from splunkd. Please enable passAuth in inputs.conf for this script Not sure how to troubleshoot this. ... View more

Hi. I have two message formats falling into the same index. One of these message formats only contains one timestamp without milliseconds, but the second format contains a second timestamp with milliseconds. For reference: Message format #1 with two timestamps, the second timestamp has milliseconds: <181>Jan 27 15:15:26 monitor2 CISE_System_Statistics 0000006805 1 0 2017-01-27 15:15:26.036 +00:00 0000036144 70001 NOTICE System-Stats: Message format #2 with one timestamp: <180>Jan 27 15:15:32 CISE_Alarm WARN: RADIUS Authentication Request dropped : I have configured the sourcetype to correctly pull out the second timestamp: TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N %:z TIME_PREFIX = \d{10}\s(?:\d\s){2} SHOULD_LINEMERGE = true This correctly processes format #1, but now events with message format #2 are merged into a single event. Is there a way to configure Splunk to pick the second timestamp from format #1, but the first timestamp for format #2? ... View more

I have the following search which creates a timechart: index=ise vendor_action=Failed_Attempts MESSAGE_CODE=5400 | timechart span=1m count by SSID The trendline works fine, if I know what the SSID values are: index=ise vendor_action=Failed_Attempts MESSAGE_CODE=5400 | timechart span=1m count by SSID | trendline sma5(SSID_1), sma5(SSID_2), sma5(SSID_3) Is there a way to display a trendline for a variable or unknown number of SSIDs? ... View more

I ran a search recently that took a couple hours to run. The number of results was pretty low - only a few thousand, but the time frame for the search was very long. Since I did not want to wait for the search to complete, I sent the job to the background. After I got the notification that the job was complete, I wanted to export the results to a CSV. But when I went to do this, it seems that the entire search gets executed again. This results in a browser timeout and I am unable to get the export. I don't recall having this problem before (I recently upgraded from 6.3.3 to 6.5.1), so I opened a support case on this. Support is telling me to pipe the search to the 'outputcsv' command. If I have to pipe the output to the outputcsv to export results, that's kind of a pain because I won't always know when it will be required because I won't always know how long the search will take. And in order for me to get an estimate and get the results, I'll have to run the search twice anyway. This doesn't feel right to me. Is my inability to obtain an export of results when the query takes a long time to run normal Splunk behavior? ... View more