Hi Giuseppe, hey I tried the above the string but it did not fetch any output, the date column was empty. | inputlookup TREND-SCANNED-PAST-30-DAYS.csv | eval date=strptime(date,"%m/%d/%Y") | sort date | eval date = strftime (date,"%m/%d/%Y") | table date count In the output the date filed is empty. When tested by breaking the query like below date filed is not displaying any output. | inputlookup TREND-SCANNED-PAST-30-DAYS.csv | eval date=strptime(date,"%m/%d/%Y") | table date. Whereas when same query with out using the eval statement, I could get the output. | inputlookup TREND-SCANNED-PAST-30-DAYS.csv | table date count Kindly guide me on this. ... View more

Hi douglashurd, thanks for your support on this, could please let me know the steps to be followed to upgrade the app. ... View more

Hi douglashurd, thanks for your effort on this, I am not sure about what version of the FirePower are being used by the security team, but from splunk side we are using estreamer for splunk 2.2.1 version and its configured in one of the heavy forwarder instances. Kindly guide me on this. ... View more

Hi Frank, Today I had pushed the above configuration to all the HF instances where splunk first sees the data, but it did not work, not sure what is going wrong in the configuration, its not over ridding the host value with the dvc field value. index=firewall sourcetype="opsec:vpn" "orig" | rex field=_raw "orig=(?[^.|]+)" | table host dvc But when the same regex is placed in the search query its working perfectly, I could see that host value is getting over written of the dvc field value. So could please guide me how to sort this out, as it is pending for very long time. ... View more

Hi harsmarvania, thanks for your support, I am not sure how to upgrade the app from the current version 2.2.0 to latest version 2.3.0. So i am planning to copy/ paste the props.conf and transforms.conf from 2.3.0 app for the source type: symantec:ep:risk:file to sourcetype:sep:host:risk in our app. The EVAL used in the props.conf to remove prefix for specific field like shown below should we need to keep that, because could see field details like Risk_Name Category_Type Server_Name etc are mention here. "EVAL-Category_Type = nullif(replace(Category_Type, "[^:]+:\s*(.*)", "\1"),"")" I did not understand this "Based on above regex and sample data which you have provide, below is run-anywhere search" from you comment. Kindly guide me on this. ... View more

Hi Frank, thanks for your effort on this, i am not too good in Regex started learning now. Mayuur provided me a query with a Regex and it worked when we executed the query from search head but when the same was used in the props.conf and transforms.conf in Heavy forwarder instance it did not work. Query Details: index=firewall sourcetype="opsec:vpn" "orig" | rex field=_raw "orig=(?<host>[^(\.|\|)]+)" | table host dvc So can I push the below change with the regex you had posted in the comments. Props.conf [opsec:vpn] TRANSFORMS-host_override = host_override Transforms.conf [host_override1] REGEX = orig=([^.|]+) DEST_KEY = MetaData:Host FORMAT = host::$1 Kindly guide me on this. ... View more

Hi Mayurr, Can you please guide me on this on how to overwrite host value = test01 with dvc filed=test02. ... View more

Hey in case if i need to upgrade app, then hole thing will be changed right because most of the configuration are customized in the 2.2.0, so kindly suggest me what will be the best solution, moreover I did not get your past comment fully in the answers.com portal. When checked in the email I could under you want to replace complete props.conf and transforms.conf details from 2.3.0 is that right. But at the same we have done lots of customization in props like adding the EVAL commands, under CIM mapping we have not used FIELDALIAS instead we have used EVAL. Kindly guide me on this please. thanks in advance. ... View more

Hi All, Can anyone guide me on this to fix the sourcefire issue. thanks in advance. ... View more

Hi harsmarvania, thanks for your effort on this, I had pasted partial config details from the app. Hey in the comments, I had shared only partial configuration details not full details. Below are the Props configuration details taken from the /opt/splunk/etc/test-sep-app/default/props.conf Props.conf Details: [sep:host:risk] TRANSFORMS-nullqueueheader = sep_file_header KV_MODE = none pulldown_type = true category = Network & Security description = Symantec Endpoint Protection agent risk events MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = false **REPORT-field_extraction_for_agt_risk = field_extraction_for_agt_risk, filename_from_filepath** REPORT-field_extraction_for_agt_risk_signature = field_extraction_for_agt_risk_signature How are you getting other fields (For example : Risk_Name,Category_Type etc. # Purpose for below "EVAL"s: remove prefix for specific field. # Note: (1) the value of the field may contain more than one colons. # e.g. "Beging Time: 2011-11-11 11:11:11" # (2) the value of field may be empty string, which should be set to be null. # e.g. "Domain: " EVAL-Category_Type = nullif(replace(Category_Type, "[^:]+:\s*(.*)", "\1"),"") EVAL-Source = nullif(replace(Source, "[^:]+:\s*(.*)", "\1"),"") EVAL-Application_Name = nullif(replace(Application_Name, "[^:]+:\s*(.*)", "\1"),"") EVAL-Group_Name = nullif(replace(Group_Name, "[^:]+:\s*(.*)", "\1"),"") EVAL-Application_Type = nullif(replace(Application_Type, "[^:]+:\s*(.*)", "\1"),"") EVAL-Source_Computer_Name = nullif(replace(Source_Computer_Name, "[^:]+:\s*(.*)", "\1"),"") EVAL-Category_Set = nullif(replace(Category_Set, "[^:]+:\s*(.*)", "\1"),"") EVAL-Computer_Name = nullif(replace(Computer_Name, "[^:]+:\s*(.*)", "\1"),"") EVAL-Secondary_Action = nullif(replace(Secondary_Action, "[^:]+:\s*(.*)", "\1"),"") EVAL-Source_Computer_IP = nullif(replace(Source_Computer_IP, "[^:]+:\s*(.*)", "\1"),"") EVAL-Domain_Name = nullif(replace(Domain_Name, "[^:]+:\s*(.*)", "\1"),"") EVAL-Risk_Name = nullif(replace(Risk_Name, "[^:]+:\s*(.*)", "\1"),"") EVAL-vendor_action = nullif(replace(vendor_action, "[^:]+:\s*(.*)", "\1"),"") Note: Only few of the EVAL stanza are shown, there are other EVAL stanza configured for other fields which are not show in the comments. Other half of the props are mentioned in the previous comments # For the case: "User Name: user1,user2" and CIM mapping etc. If you have props.conf and transforms.conf in default and local directory of add-on, can you please provide configuration from both the directory? We have other props.conf and transforms.conf present under local directory but it refers another sourcetype called sep:host:agt_system. It contains stanza field extraction for signature_version,engine_version and component_versions and Eval-Vendor="symantec" In transforms.conf we have below stanza configured. [field_extraction_for_signature_version] SOURCE_KEY = Event_Description REGEX = New virus definition file loaded.\s+Version\S+\s+(?<signature_version>.*) likewise for other stanzas are configured like above. So kindly guide me where is the issue, why Symantec data are not parsing correctly for the source type sep:host:risk ... View more

Hi All, Can anyone guide me on how to fix this issue. thanks in advance. ... View more

Hi Harsmarvania, thanks for your response on this, hey we are using the symantec Endpoint Protection add-on 2.2.0 version in our environment. We have placed this app in the Heavy forwarder instances. I had compared both the version 2.2.0 and 2.3.0 for the Splunk Add-on and for this sourcetype=sep:host:risk in props.conf and Transforms.conf, could see some difference between them, but I am not sure whether we had done some customization for the add-on 2.2.0 based on our requirements. Details on Props.conf: [sep:host:risk] REPORT-field_extraction_for_agt_risk_signature = field_extraction_for_agt_risk_signature Note: Apart from other stanza present in Props.conf for Endpoint app 2.3.0, only the above stanza is added additional. # For the case: "User Name: user1,user2" ## For CIM mapping ## EVAL-date = nullif(replace(Event_Time, "[^:]+:\s*(\S+)\s.*", "\1"),"") EVAL-src = nullif(replace(Source_Computer_Name, "[^:]+:\s*(.*)", "\1"),"") LOOKUP-risk_vendor_action_to_action = symantec_ep_action_lookup vendor_action OUTPUT action LOOKUP-risk_category_lookup = symantec_ep_malware_category_lookup title as SEP_risk_signature OUTPUT type as category riskLevel as Risk_Level type as SEP_risk_category riskLevel as SEP_Risk_Level Note : Under CIM mapping stanza instead of Field Aliases, we have used EVAL and Regex. Transforms.conf Details: REGEX = (?i)(?:[[sep_file_preifx]]),\s*(? [[sep_file_field]]),\s*(? [[sep_file_field]]),\s*(? [[sep_file_field]]),\s*(? [[sep_file_field]]),\s*(? [[sep_file_field]]),\s*(? [[sep_file_field]]),\s*(? [[sep_file_field]]),\s*(? [[sep_file_field]])(?:,\s*(? [[sep_file_field]]),\s*(? [[sep_file_field]]))? Note: Only partial field Regex are show in the comment, there are other fields which follows the same Regex. ##Extract for source_key## [filename_from_filepath] SOURCE_KEY = file_path REGEX = ([^\\/]+)$ FORMAT = file_name::$1 Note : field_extraction_for_agt_risk_signature, this stanza is added for better performance of eventtype. Kindly guide me on how/where to correct the configuration to make the parsing work correctly. ... View more

Hi Team, Can any one guide me how to fix this issue. thanks in advance. ... View more

Hi Team, Can you guide me on the parsing issue and help me in fix this problem. thanks in advance. ... View more

Hi asiddique, it did not fetch the data from the wtmpx file though I had given the complete permission to execute the commands. Permission Details: -rwxrwxr-x 1 splunk splunk 2789 Jan 25 06:52 who.sh -rwxrwxr-x 1 splunk splunk 2835 Jan 25 06:52 lastlog.sh -rwxrwxr-x 1 splunk splunk 3091 Jan 25 06:52 common.sh But still unable to read the binary file from /var/adm/wtmpx , so kindly guide me to enable log monitoring. thanks in advance. ... View more

Hi Hexx, Got a request to monitor the wtmpx file in splunk, but I am not sure how to create a script to read and write the data from wtmpx file from /var/adm/wtmpx and output the data into a text file, which splunk can read it. If you can guide me on creating a script, it will be great help. thanks in advance. ... View more

Hi asiddique, Nickhillscpl was able to clarify the doubts both of my questions. So I am accepting this answer. But I am not sure how to get this is done using the link shared by nickhillscpl. If you need me to open a new question for the same, I can do that. https://answers.splunk.com/answers/5844/can-i-splunk-my-wtmp-files.html thanks in advance. ... View more

Hi mayurr, we had pushed above changes but it did not work, so kindly guide me how /where to check Error/Info for this sourcetype and also help me to fix this issue. thanks in advance. ... View more

Hi Micahkemp, thanks for your effort on this. we had just copy pasted the below props.conf and transforms.conf along with other stanza's and pushed to the Heavy Forwarder instances via deployment server and reload the DP instances. Props.conf: [opsec] TRANSFORMS-orig_as_host Transforms.conf: [orig_as_host] REGEX = orig=([^|]+)| DEST_KEY = MetaData:Host FORMAT = host::$1 The moment it was pushed to the prod, we could not see any new events being ingested into splunk, we had waited for an hour but no luck, then decided to test the regex in the splunk console and got the above Error. index=firwall sourcetype="opsec*" | rex field=_raw "orig=([^|]+)|" | table host dvc But It was working fine when I use the below search string index=firewall sourcetype="opsec:vpn" "orig" | rex field=_raw "orig=(?[^(.||)]+)" | table host dvc So could you please guide me on this, to fix the issue. thanks in advance. ... View more

Hi Mayurr, thanks for your effort on this, I have not pushed this change yet, since we have three different source types configured to fetch data. In this case can I configure the props.conf and transforms.conf like this. Props.conf [opsec] TRANSFORMS-host_override1 = host_override1 [opsec:vpn] TRANSFORMS-host_override2 = host_override2 [opsec:audit] TRANSFORMS-host_override3 = host_override3 Transforms.conf [host_override1] REGEX = orig=(?[^(.||)]+) DEST_KEY = MetaData:Host FORMAT = host::$1 [host_override2] REGEX = orig=(?[^(.||)]+) DEST_KEY = MetaData:Host FORMAT = host::$1 [host_override3] REGEX = orig=(?[^(.||)]+) DEST_KEY = MetaData:Host FORMAT = host::$1 Kindly guide me on this. thanks in advance ... View more

Hi Micahkemp, could you please guide me to fix this issue. I am still unable to fix this issue. thanks in advance. ... View more

hi micahkemp, could you please guide me on this . ... View more