@saravanan90  Thanks for your reply. Search result's count is mismatching. It should give 45 counts without "Zscaler Miami III "but i am getting only 30 values as result. ... View more

We can create a scheduled search & save the results to separate index by using collect command in Splunk. https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Collect   ----------------- An upvote would be appreciated if the above comment helps. ... View more

Thanks for the reply! Just what I needed and much appreciated.  ... View more

Hi @deepmis, the message you have means that the client cannot reach to send logs to the indexer because it's closed the connection. At first a stupid question. di you enabled receiving on Indexer? on port 9997? If yes, try using telnet to see if the connection is open from the client to the indexer: telnet ip_indexer 9997 then verify that the IP addresses of your computers are in the same network. Ciao. Giuseppe ... View more

@fdevera  You could use a regular expression to create a new field for the subdomain, then call that new field in your table. | rex field=src "(?<justthesubdomain>.+?(?=\.))" | table justthesubdomain   ... View more

Thanks, did this and it led me to investigate props.conf on HF's that was having issues. ... View more

This may help.. https://docs.splunk.com/Documentation/DBX/3.0.2/DeployDBX/Commands#procedure -------------------- An upvote would be appreciated if the above reply is useful to you.   ... View more

Thank you. ... View more

Yes it will. The precedence order will be of the below.  source host sourcetype https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Attributeprecedencewithinafile#Precedence_for_events_with_multiple_attribute_assignments --- An upvote would be appreciated if the above comment is helpful. ... View more

It might be configured in some other apps. Please check the value through btool. ./splunk btool indexes list _audit --debug | grep frozenTimePeriodInSecs ... View more

Yes, it is possible in UF that you can enable a UDP/TCP port and start receiving logs from network appliance. Check the firewall communication between network devices -- > UF --> Indexers. ... View more

There  is an option in aide to get the logs in syslog format (in a single line). Please add the below lines in aide.conf.  syslog_format = true report_url=syslog:LOG_AUTH   In man pages about aide.conf syslog_format Valid values are yes,true,no and false. This option enables new syslog format which is suitable for logging. Every change is logged as one simple line. This option changes verbose level to 0 and prints everything that was changed. It is suggested to use this option with "report_url=syslog:...". Default value is "false/no". Maximum size of message is 1KB which is limitation of syslog call. If message is greater than limit, message will be truncated. Option summarize_changes has no impact for this format. Output always starts with: "AIDE found differences between database and filesystem!!" And it is followed by summary: summary;total_number_of_files=1000;added_files=0;removed_files=0;changed_files=1 And finally there are logs about changes: dir=/usr/sbin;Mtime_old=0000-00-00 00:00:00;Mtime_new=0000-00-00 00:00:00;... ... View more

There  is an option in aide to get the logs in syslog format (in a single line). Please add the below lines in aide.conf. syslog_format = true report_url=syslog:LOG_AUTH ... View more

Splunk Forwarder can be run with normal domain account. Admin privileges are not necessary. Incase if you are collecting windows event logs, provide access to the domain account through GPO policies. ... View more

Please check the "acceptFrom" parameter from web.conf   acceptFrom = <network_acl> ... * Lists a set of networks or addresses from which to accept connections. * Separate multiple rules with commas or spaces. * Each rule can be in one of the following formats: 1. A single IPv4 or IPv6 address (examples: "10.1.2.3", "fe80::4a3") 2. A Classless Inter-Domain Routing (CIDR) block of addresses (examples: "10/8", "192.168.1/24", "fe80:1234/32") 3. A DNS name, possibly with a "*" used as a wildcard (examples: "myhost.example.com", "*.splunk.com") 4. "*", which matches anything * You can also prefix an entry with '!' to cause the rule to reject the connection. The input applies rules in order, and uses the first one that matches. For example, "!10.1/16, *" allows connections from everywhere except the 10.1.*.* network. * Default: "*" (accept from anywhere)   ... View more

In props.conf [host::F5sendingIp] TRANSFORM-null = remove_junk In transforms.conf [remove_junk] REGEX=default send string DEST_KEY=queue FORMAT=nullQueue Use this config where parsing happens. ... View more

While creating a new HEC token from the master cluster portal, the HEC token generated is located in master cluster VM in the following path= /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf. How should we push the HEC token from master cluster to the indexer peer using Config bundle action? Should we manually copy the inputs.conf from /opt/splunk/etc/apps/splunk_httpinput/local to /opt/splunk/etc/master-apps/splunk_httpinput/local and then Validate and push the config bundle to indexer? ... View more

Run the below command & update the replication_factor, site_replication_factor manually in server.conf as below. splunk edit cluster-config -mode master -multisite true -available_sites site1,site2 -site site1 -site_replication_factor origin:2,total:3 -site_search_factor origin:1,total:2 [clustering] mode = master multisite = true available_sites = site1,site2 site_replication_factor = origin:1,total:2 site_search_factor = origin:1,total:2 replication_factor = 2 Refer the below link. https://answers.splunk.com/answers/294071/indexer-cluster-error-site-replication-factor-orig.html ... View more

Try running the below python script directly for diag. ./splunk cmd python $SPLUNK_HOME/lib/python2.7/site-packages/splunk/clilib/info_gather.py ... View more

Paste the query in search box and press Ctrl+shift+E. You will get to know the full query, modify the query based on your requirement. "Threat - Source And Destination Matches - Threat Gen" check logs from datamodels of Network_Traffic, Web & IDS. ... View more