Hi Nickhill, can you guide me on how to create an scripted inputs for getting the data file into splunk. thanks in advance. ... View more

thanks Nickhill for the update, but now I am not sure how to write a scripted input to monitor this file and index into splunk by following the below approach. 1) Set up a scripted input calling a shell script that executes "who" or "last" with the options you need and that will index the generated output. This is the simplest approach. So can you please guide me how to create an scripted inputs for my requirement please. ... View more

Hi wtmpx,utmpx are the data files which does not have any extension and I could see some warning message in the splunkd.log . 01-16-2018 08:06:47.560 -0500 WARN FileClassifierManager - The file '/var/adm/utmpx' is invalid. Reason: binary 01-16-2018 08:06:46.560 -0500 WARN FileClassifierManager - The file '/var/adm/wtmpx' is invalid. Reason: binary ... View more

Hi wtmpx,utmpx are the data files which does not have any extension and I could see some warning message in the splunkd.log . 01-16-2018 08:06:47.560 -0500 WARN FileClassifierManager - The file '/var/adm/utmpx' is invalid. Reason: binary 01-16-2018 08:06:46.560 -0500 WARN FileClassifierManager - The file '/var/adm/wtmpx' is invalid. Reason: binary. So let me know whether, I can use the new regex which you had mentioned in the comment. thanks in advance. ... View more

Hi Nickhill, I am unable to see Error message but could see the Warning message in splunk when I search index="_internal" host=test01 log_level=WARN 01-16-2018 08:06:47.560 -0500 WARN FileClassifierManager - The file '/var/adm/utmpx' is invalid. Reason: binary 01-16-2018 08:06:46.560 -0500 WARN FileClassifierManager - The file '/var/adm/wtmpx' is invalid. Reason: binary Kindly let me know how to monitor these files in splunk. ... View more

Hi, thanks for you support on this but I am unable to monitor the "wtmpx|utmpx" file from the path /var/adm/ on the remote host. But we could monitor other files ".log|log$|message" are being ingested into splunk . Similarly for the second stanza also we are unable to monitor the "wtmp|btmp" files from the path /var/log/ on the remote host. But we could monitor other files ".log|log$|secure|message|auth|cron$|.out" are being ingested into splunk . Kindly guide me how to fix this issue, we need to pull the wtmpx, utmpx, wtmp,btmp in splunk. ... View more

Hi Mayurrr98, thanks for you support on this but I am unable to monitor the "wtmpx|utmpx" file from the path /var/adm/ on the remote host. But we could monitor other files ".log|log$|message" are being ingested into splunk . Similarly for the second stanza also we are unable to monitor the "wtmp|btmp" files from the path /var/log/ on the remote host. But we could monitor other files ".log|log$|secure|message|auth|cron$|.out" are being ingested into splunk . Since already we are able to get the other files "message|auth|cron" etc info in splunk, I did not change the regex, just added the new file name in the stanza along with other file name. Kindly guide me how to fix this issue, we need to pull the wtmpx, utmpx, wtmp,btmp in splunk. ... View more

Hi Nickhill, thanks for you support on this but I am unable to monitor the "wtmpx|utmpx" file from the path /var/adm/ on the remote host. But we could monitor other files ".log|log$|message" are being ingested into splunk . Similarly for the second stanza also we are unable to monitor the "wtmp|btmp" files from the path /var/log/ on the remote host. But we could monitor other files ".log|log$|secure|message|auth|cron$|.out" are being ingested into splunk . Kindly guide me how to fix this issue, we need to pull the wtmpx, utmpx, wtmp,btmp in splunk. ... View more

Hi Somesoni2, thanks for working on this issue, hey I could see the following error details in the splunkd.log for this particular user who is facing the issue. When checked for a period of last 30 days we could see the below error occurring on and off. Similarly when checked in metrics.log and splunkd_ui_access could not see any error. Splunkd.log ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="user500". Search filter="(&(uniquemember=uid=user500,ou=internal,ou=users,dc=test,dc=com)(cn=Splunk_Admin))" strategy="test LDAP" So could you please guide me how to fix this issue. thanks in advance. ... View more

Hi Mayurr, thanks for your effort on this, I had tried the above search and i could see only the info message available in the log_level filed. So could you please let me how to find out why the search had failed to pull the information from the AD. thanks in advance. ... View more

Hey but In that case we are unable to match the _time value and log_time in the event field value with the current time. Our requirement is that we want _time should have current time and the same time should match the log_time value in the event field. Is there a possibility to do this. Kindly guide me on this. thanks in advance. ... View more

Hi richgalloway, thanks for your effort on this, actually I had tried to test this by ingesting the sample data in to the indexer instance via GUI Settings-->Add Data --> Upload -->select source-->setsourcetype--> "symantec:tap:incidentevents" timestamp --> Advanced Timezone --> "Auto" Timestampformat -->"%Y-%m-%dT%H:%H:%S.%3N%Z" Time stamp Preffix -> log_time:\s+ Lookhead --> 27 By following the above steps, we could see that the index time is changed to the current time zone but at the same time I am unable to match the log_time filed in the events with the index time. Example : _time: 1/4/18 5:26:52.000 AM and log_time: 2018-01-02T17:13:01.490Z field in the events are not matching . If we remove the Timestampformat -->"%Y-%m-%dT%H:%H:%S.%3N%Z" and make changes Time stamp prefix = log_time then I could see that _time: 1/2/18 5:13:01.490 PM and log_time: 2018-01-02T17:13:01.490Z . Is there a possibility that we can match _time value and log_time in the event field value with the current time zone. Kindly guide me on this please. ... View more

Hi richgalloway, thanks for your effort on this, we are getting the below events details after executing the query. Currently system time is 12:37 PM EST whereas _time shows as 5:13:01.490 PM, so how to correct the props.conf to fix this issue. 1/2/18 5:13:01.490 PM { [-] actual_action: Left alone actual_action_idx: 4 agent_version: 14.0.3752.1000 atp_host: 10.x.x.x data_source_url_domain: device_ip: 10.x.x.x device_name: node01 device_time: 2018-01-02T17:08:28.000Z device_uid: d41db0f9-4f98-484d-92b3-ca03e6a33d46 domain_name: test.com external_ip: file: { [+] } host_name: node01 incident: 2daf1330-ef75-11e7-fb05-0000000000e1 internal_ip: 10.x.x.x local_host_mac: 00-05-9a-3c-7a-00 log_name: epmp_incident-2018-01-02/event log_time: 2018-01-02T17:13:01.490Z no_of_viruses: 1 sep_installed: true source: Real Time Scan threat: { [+] } type_id: 4123 user_name: user1 uuid: 2ffcd120-efe0-11e7-f1d4-000000004810 virus_def: 2018-01-01 rev. 003 virus_name: XXX.XXXXX } Kindly guide me what TIME_FORMAT should be used based on the above events and shall I include TZ = EDT along with other props.conf stanza details. ... View more

Hi Micahkemp, thanks for guiding me on this issue. ... View more

Hi naidusadanaia, thanks for your effort all are in the same location. still we could see data being ingested in future time stamp. Kindly guide me to fix the issue. ... View more

Hi Micahkemp, Good Morning and Wish you a Happy New year. Hey it worked but I had taken this regex ""sudo:.*?COMMAND=(?[^;]+)(;|$)"" and pushed the below stanza details in props.conf along with other stanza details and it worked fine. Thanks for guiding me on this. Props.conf [linux_secure] EXTRACT-command = "sudo:.*?COMMAND=(?[^;]+)(;|$)" ... View more

Hi ddrillic, thanks for your effort on this, It will be great if you can share some videos related to parsing, as I use to get most of the issues related to parsing in my organization. thanks in advance. ... View more

Hi Niketnilay, thanks for your effort on this, hey in my environment, we use to get lots of issue related to parsing and i use to go through the props.conf documentation for any parsing related issues, but I am finding it very difficult in resolving the issues tough i am reading the documents very patiently but still unable to get into it. So it will be good if i get any video on the same, any how I will go though the Interactive Field Extraction documentation again. Meanwhile if you can share me link on the same it will be great. ... View more