In index.conf on the universal forwarder machine create a different udp port for each firewall. Send to that port from the firewall that belongs to that index. [udp://portfromfirewall] connection_host = ip index = index_you_want_to_send_to sourcetype = your_Sourcetype In your outputs.conf [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = yoursplunkserver:9997 [tcpout-server://yoursplunkserver:9997] ... View more

It sounds very strange. If you search for * you will get all the raw data. Which you could then export. So leaving the data at the indexers but being allowed to search them provides no security whatsoever. ... View more

What is the bandwidth to those sites? Since the remote indexers do not store much data, you may want to forward that data to the local indexer or set up a separate indexer locally to allow a search to that server with higher bandwidth. If you forward that data with splunktcp from the remote indexers you will be assured that the information gets there eventually over the slower links. ... View more

Per Splunk inputs.conf doc the host_regex extracts from the path, not the filename. Alternate solution. Put each server log in it's own folder and use host_regex or easier use host_segment. ... View more

I forgot to mention that this server has 2 nics. One on each network to bridge the routing gap. I opened the syslog port in the inputs.conf and forwarded the data to the production network splunk server. Thanks for the answer. ... View more

Ah. Sorry. Search newName will literally search for the term newName whereas you want to search for its value. I am unsure how to extract the value from newName to pipe into a new search. ... View more

Or just | search newName ... View more

I was illustrating the replace function. Your search is stating you want to see everything in _internal. You'll want to add this to the end of the search: | search whatyourelookingfor=newName if I am understanding what you are trying to do correctly. ... View more

Thank you much. I was unaware that list sorted independently. ... View more

Unsure of how to post code in comment, so I'm asking in answer. Does it have to be in a regex or can you do this replacement in a search? Ex: your search | eval newfilename=$filename$ | replace *.jpg with *-456.bmp in newfilename ... View more

Create field extractions instead of doing a rex in search. Then you can do a search line this: source="toto.log" | stats list(dstip),list(dstport) by srcip ... View more

Unfortunately this won't work. I have a dash that shows failed logins because the user is an unknown user. I have another dash that shows legitimate user failed logins. I want them to be mutually exclusive. That is I do not want to see the unknown users failures in my legitimate user dash. But the data source gives me 2 events for the unknown users. One with the (Unknown user) prefix on the username and the other with just the username. If I do a NOT command I will only filter out the (Unknown user) event. Leaving me with the other event from that user I want to remove. ... View more

What is your search string? ... View more

Your question gave me the excuse to actually reprogram one of my dashes to correctly view authentications on a windows NPS server. ... View more

sourcetype="WinEventLog:Security" AND EventCode=4720 | eval AccountCreator=mvindex(Account_Name,0) | eval AccountCreated=mvindex(Account_Name,1)| table _time, host, AccountCreator, AccountCreated The mvindex command will pull the values out for you into a new field name you create. ... View more

I have an open case with Splunk on this. No way to currently import email via LDAP. No ETA on fix. ... View more

I haven't tried this, but it looks like it should work if you can regex the header line. Straight from the deployment manual page 69: Discard specific events and keep the rest This example discards all sshd events in /var/log/messages by sending them to nullQueue: In props.conf, set the TRANSFORMS-null attribute: [source::/var/log/messages] TRANSFORMS-null= setnull Create a corresponding stanza in transforms.conf. Set DEST_KEY to "queue" and FORMAT to "nullQueue": [setnull] REGEX = \[sshd\] DEST_KEY = queue FORMAT = nullQueue That does it. ... View more

regex is painful for me as well. Try the interactive field extractor or the | erex command. Much easier. ... View more

On a computer with the Universal Forwarder installed. Click start->Run->regedit Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Edit->Find then enter splunk In that key you will see the UninstallString. Double click and copy that value. Click start->Run-> cmd at cli right click and paste that value. add /qn at the end of that string to silently uninstall. Ex. for ver 5.0.2.149561 Win7 MsiExec.exe /X{73B67D46-99DB-40C8-9E76-9F870C519257} /qn If you want to push this remotely there are many ways. I like psexec. Google pstools to download. Example installer below. You could modify for the uninstaller. Running this in a bat file or from cli will open a new cmd prompt to uninstall. Let it finish with an exit code before closing. start cmd /k psexec \\#ipadd# -u "domain\domainadmin" -p "password" msiexec.exe /i "\\server\SplunkForwarder\splunkforwarder-5.0.2-149561-x86-release.msi" RECEIVING_INDEXER="splunkserver:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_FWD_ENABLE=1 WINEVENTLOG_SET_ENABLE=1 AGREETOLICENSE=Yes /quiet ... View more