Hi All, Just getting the community consensus here. Cisco ASA log events for Built and Teardown essentially contain the same information http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116149-qanda-ASA-00.html The Cisco ASA TA does the following for each type of event Built Extracts standard fields Extracts direction swaps around src and dest fields for Outbound connections Teardown Extracts standard fields Extracts bytes and duration Now, is direction really that relevant as it can be inferred from the src and dest fields? The rest of the fields are pretty much replicated between the two types of events. Which brings me to my main question: Will dropping "Built" events have any impact on Splunk Enterprise Security dashboards? It would essentially halve the traffic ingested into Splunk for the firewall. ... View more

Hi All, Seeing some very strange results from a DB input. [mi_input://SVR-DEV] connection = SVR-DEV index = server_application interval = 43200 max_rows = 10000 mode = tail output_timestamp_format = YYYY-MM-dd HH:mm:ss query = Select * from log.log_event_logs source = dbx2:svr-dev sourcetype = db:svr tail_follow_only = 1 tail_rising_column_name = EVENT_LOG_ID tail_rising_column_number = 4 ui_query_catalog = NULL ui_query_mode = advanced ui_query_schema = undefined ui_query_table = undefined input_timestamp_column_name = EVENT_TIMESTAMP input_timestamp_column_number = 11 tail_rising_column_checkpoint_value = 215663 disabled = 1 Now for the interesting part. DB Connect 2 performs the following "2015-12-30 08:50:10" EVENT_LOG_ID=157931, EVENT_TIMESTAMP=1419889810000, EVENT_TYPE="INVALID_ROLE", EVENT_SEVERITY_CODE="ERROR", EVENT_TEXT="Message authorization failed for id:", EVENT_DETAIL_DATA="A............ Note EVENT_TIMESTAMP=1419889810000 which is a millisecond timestamp of 1419889810.000 which equates to Mon, 29 Dec 2014 21:50:10 GMT adjusting for timezone +10 hours = Mon, 30 Dec 2014 8:50:10 So the first issue here is DB Connect 2 added a year to the date! The second issue is _time for this event is 24/11/2015 08:50:10.000! I can see the time 8:50:10 is right but where did it get 24/11/2015 from??? Further investigation into the event in Splunk 24/11/2015 was the index time. So does anyone know to resolve this The timestamp is getting broken in ingestion of the data (adding one year) _time is a Frankenstein combination of index_time (date) and the timestamp (time) To be clear no changes have been made to MAX_DAYS_AGO (default 2000 days) and MAX_DAYS_HENCE (default 2 days) so these should be fine with defaults. The only other thing I can think of would be a props.conf entry for the TIME_FORMAT to specifically tell Splunk to match the output_timestamp_format in the DB input definition. But it is a pretty standard format I would have thought Splunk would recognise it in an instant. ... View more

So this example dashboard will work on any Splunk instance. Myself and our other engineers can't seem to get the input at the top of the form to update? The only solutions we can think of would be either custom javascript or have the page submit to itself with the fields passed in the URL. Test dashboard below. <form> <label>Drilldown Example Table Complex</label> <fieldset submitButton="false"> <input type="text" token="component"> <default>*</default> </input> </fieldset> <row> <panel> <table> <search> <query>index=_internal sourcetype=splunkd| stats count(eval(log_level="INFO")) as INFO count(eval(log_level="ERROR")) as ERROR by component</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> <drilldown> <condition field="component"> <set token="component">$click.value$</set> <set token="log_level">*</set> </condition> <condition field="INFO"> <set token="log_level">$click.name2$</set> <set token="component">$click.value$</set> </condition> <condition field="ERROR"> <set token="log_level">$click.name2$</set> <set token="component">$click.value$</set> </condition> </drilldown> </table> </panel> </row> <row> <panel> <table> <title>Search = index=_internal component="$component$" log_level="$log_level$"</title> <search> <query>index=_internal component="$component$" log_level="$log_level$"</query> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">cell</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more

Hi All, Just trying to work out how to use eventgen for multiline logs such as oracles' hideous audit file. Audit file /ora/app/oracle/admin/cdh/adump/oracle_audit_log.aud Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production ORACLE_HOME = /ora/app/oracle/product/11.2.0.4/db_1 System name: SunOS Node name: hostname-oracle4 Release: 5.10 Version: Generic_150400-26 Machine: sun4v Instance name: this_instance Redo thread mounted by this instance: 1 Oracle process number: 90 Unix process pid: 5542, image: oracle@hostname-oracle4 Mon Nov 2 11:33:30 2015 +11:00 LENGTH: "223" SESSIONID:[8] "23491997" ENTRYID:[1] "1" USERID:[6] "SIEM_TEST1" ACTION:[3] "44" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "0" LOGOFF$LREAD:[2] "24" LOGOFF$LWRITE:[1] "0" LOGOFF$DEAD:[1] "0" DBID:[9] "847685182" SESSIONCPU:[1] "4" Mon Nov 2 11:33:33 2015 +11:00 LENGTH: "223" SESSIONID:[8] "23491997" ENTRYID:[1] "1" USERID:[6] "SIEM_TEST1" ACTION:[3] "115" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "0" LOGOFF$LREAD:[2] "24" LOGOFF$LWRITE:[1] "0" LOGOFF$DEAD:[1] "0" DBID:[9] "847685182" SESSIONCPU:[1] "4" I have tried this in evengen.conf [oracle_audit_log.aud] disabled = false mode = replay index=sec_database sourcetype=oracle:audit:text # breaker= ^\r\n bundlelines = true ## Generate all events in sample count = 0 earliest = -5m latest = now interval = 300 outputMode=spool spoolFile = sample.oracle # host.token # host.replacement = hosts.list ## Replace timestamp token.0.token = \w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4} token.0.replacementType = timestamp token.0.replacement = %a %b %d %H:%M:%S %Y But it throws this error 2015-11-03 13:55:51,350 INFO Retrieving eventgen configurations from /configs/eventgen 2015-11-03 13:55:51,894 INFO Creating timer object for sample 'oracle_audit_log.aud' in app 'TA_ob-3_oracle_eventgen' 2015-11-03 13:55:51,896 INFO Starting timers 2015-11-03 13:55:51,898 ERROR Can't find a timestamp (using patterns '['\\w{3}\\s+\\w{3}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2}\\s+\\d{4}']') in this event: 'LENGTH: "223" '. 2015-11-03 13:55:51,901 ERROR Exception in sample: oracle_audit_log.aud Traceback (most recent call last): File "/opt/splunk/etc/apps/SA-Eventgen/bin/eventgen.py", line 47, in run partialInterval = self.sample.gen() File "/opt/splunk/etc/apps/SA-Eventgen/lib/eventgensamples.py", line 506, in gen self._lastts = self._getTSFromEvent(self._rpevents[self._currentevent]) File "/opt/splunk/etc/apps/SA-Eventgen/lib/eventgensamples.py", line 702, in _getTSFromEvent raise ValueError("Can't find a timestamp (using patterns '%s') in this event: '%s'." % (formats, event)) ValueError: Can't find a timestamp (using patterns '['\\w{3}\\s+\\w{3}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2}\\s+\\d{4}']') in this event: 'LENGTH: "223" '. I'm guessing it is trying to find a timestamp on every line, but obviously one does not exist. I even tried messing around with breaker. I even removed all the junk at the top of the log with no luck. Any ideas would be appreciated. ... View more