Hi micahkemp, it worked after removing the double quotes from the Extract command. micahkemp, I am finding difficulties in Field Extraction (Parsing), I tried learning the Under Props.conf documentation -- Field Extraction but could not understand it, so could please let me know is there way where I can get an Video on Field Extraction (parsing). If you had come across any good video explaining on Field Extraction both Index time and Search time , please share the link with me. thanks in advance . ... View more

Hi micahkemp, can you please guide me on the above comment. thanks in advance. ... View more

Hi Micahkemp, thanks for your effort on this, yes I had tested the regex by executing it on regex101.com and it worked fine, but so can I push the same regex in my props.conf and deploy to the search head cluster master and the indexer. props.conf : [linux_secure] EXTRACT-command = sudo.*COMMAND=(?<command>[^;]+)( ;|$) Kindly guide me on this please. ... View more

hi somesoni2, can you please guide me on this, i am not sure why its not taking the complete command line information in command line field(interesting field) . It worked well when executed the below query in the search head. index=unix sourcetype=linux_secure COMMAND | rex "sudo:.*?COMMAND=(?<COMMAND>[^;]+)(;|$)" 12/15/17 9:34:31.000 AM Dec 15 09:34:31 test01 sudo: solarwinds : TTY=pts/2 ; PWD=/opt/solarwinds ; USER=root ; COMMAND=/opt/solarwinds/utilities/check_file.sh -e -f /var/log/audit/audit.log But the same regex did not work when pushed from props.conf with below stanza added and deployed to the search head cluster members. [linux_secure] EXTRACT-command = "sudo:.*?COMMAND=(?[^;]+)(;|$)" "Problem"- COMMAND is currently parsed as "/opt/solarwinds/utilities/check_file.sh" "Exact Requirement"- Want it parses as "/opt/solarwinds/utilities/check_file.sh -e -f /var/log/audit/audit.log" Please guide me on this .... I am not sure where its going wrong. ... View more

Hi Kamlesh, thanks for your effort on this, Hey I am very new to this app and integration with service now was done by splunk SME at onsite, so please guide me on the below questions. 1) What user id and password do we need to use to login in to the below URL, I mean do we need to use splunk user id used for integration of service now or our regular service now username and password to check for the incidents, problems etc . 2) Why do we need to use this URL, is that anything related to the Error message ? 3) Where I can get the Servicenow table that are used in splunk to ingest data, will this be available in /opt/splunk/etc/apps/Splunk_ta_snow/local/inputs.conf 4) I am not sure about the username and password that was used for splunk integration with service-now. I checked /opt/splunk/etc/apps/Splunk_ta_snow/local/passowrd.conf but its encrypted. Sorry for asking these questions but based on the inputs, I will be making the first step in this issue. thanks in advance ... View more

HI Dal Jeanis, can you please guide me on this, i am not sure why its not taking the complete command line information in command line field. It worked well when i executed the query in the search head. index=unix sourcetype=linux_secure COMMAND | rex "sudo:.*?COMMAND=(?<COMMAND>[^;]+)(;|$)" 12/15/17 9:34:31.000 AM Dec 15 09:34:31 test01 sudo: solarwinds : TTY=pts/2 ; PWD=/opt/solarwinds ; USER=root ; COMMAND=/opt/solarwinds/utilities/check_file.sh -e -f /var/log/audit/audit.log But the same regex did not work when we pushed from props.conf with below stanza added and deployed to the search head cluster members. [linux_secure] EXTRACT-command = "sudo:.*?COMMAND=(?[^;]+)(;|$)" Please guide me on this. thanks in advance. ... View more

Hi All, Can you please guide me on this, I had pushed the above props.conf file into the search head via deployer but no luck still I could see only partial command information present in the command field. [linux_secure] ## Event extractions by type REPORT-0authentication_for_linux_secure = ssh-login-events, ssh-session-close, ssh-disconnect, sshd_authentication_kerberos_success, sshd_authentication_refused, sshd_authentication_tried REPORT-account_management_for_linux_secure = useradd, userdel REPORT-firewall = ipfw, ipfw-stealth, ipfw-icmp, pf REPORT-routing = iptables EXTRACT-command = "sudo:.*?COMMAND=(?[^;]+)(;|$)" When I searched using the above regex its working, I could see the entire command information in command line. But same when I added into the Props.conf for the sourcetype = linux_secure and pushed the changes in splunk it did not work, I am getting the partial command information in Command line field. Kindly guide me how to parse entire command line information in the command field. ... View more

Hi Dal Jeanis, Good Morning, can you please guide me on the above comment, so that I can push the props.conf to the search head cluster via deployer. thanks in advance. ... View more

Hi All, Can any one guide me on this please, I am not sure how to investigate/troubleshoot this issue. thanks in advance. ... View more

Hi All, Can you guide me on this please, I am not sure how to investigate this issue. thanks in advance. ... View more

thanks rphillips, let me check by executing the above query and post you the result based on the output. ... View more

Hi Dal Jeanis, Can you please guide me on the above comment, so that I can push the changes to the search head master. thanks in advance. ... View more

Hi Dal Jeanis, thanks for your effort on this, Just checked all the events which are getting populated when we execute the below query and found that all the events are having SUDO. I have also tested the regex which you had posted above along with query and it works fine getting the complete command details in the command field. index=unix sourcetype=linux_secure COMMAND | rex "sudo:.*?COMMAND=(?<COMMAND>[^;]+)(;|$)" Dec 14 15:00:21 test02 sudo: solarwinds : TTY=pts/3 ; PWD=/opt/solarwinds ; USER=root ; COMMAND=/opt/solarwinds/utilities/check_file.sh -e -f /var/log/audit/audit.log Can I push the below props.conf in the search head cluster environment. [linux_secure] ## Event extractions by type REPORT-0authentication_for_linux_secure = ssh-login-events, ssh-session-close, ssh-disconnect, etc EXTRACT-command = "sudo:.*?COMMAND=(?[^;]+)(;|$)" Kindly guide me on this. thanks in advance. ... View more

thanks adonio... let me check the report once again. ... View more

hey then how to find out the accelerated reports configured in our environment. So you mean to say that data model acceleration is different from Accelerated reports. When I execute this query i am getting below results: index=_internal source=*scheduler.log* savedsearch_name=*ACCELERATE* | dedup savedsearch_name host | table savedsearch_name host _ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_DA-deployment_monitor_nobody_66aacf41e8ea33d9_ACCELERATE_ _ACCELERATE_DM_Splunk_SA_CIM_Network_Sessions_ACCELERATE_ _ACCELERATE_DM_Splunk_SA_CIM_Network_Resolution_ACCELERATE_ _ACCELERATE_C090FDA2-105E-4875-A110-3F13FF986151_SA-critical_security_controls_admin_85ce9a3b65831f9d_ACCELERATE_ _ACCELERATE_C090FDA2-105E-4875-A110-3F13FF986151_SA-critical_security_controls_admin_3c59e7c4c93a6544_ACCELERATE_ Kindly guide me whether these reports are accelerated report or data model acceleration. ... View more

hey in the splunk search console we could see Events, Pattern, statistics, Visualization tabs right, in these under statistic tab, I could see 85 count. Yes I have gone through each reports under --> settings-->searches,report,alerts,--> Specific Report name-->icon with thunder symbol and when placed over the symbol it pops out - This model is accelerated. thanks for your help on this. ... View more

Hi Adonio, thanks for your effort on this, After executing the above query, I am getting some report details with statistics count as 85, So it mean we have 85 reports configured as Accelerated Reports or how do I confirm that they are all configured as Accelerated Reports. Also I am getting statistics count as 261 when I execute the below query, so what is the difference between savedsearch_name=ACCELERATE and your query. index=_internal source=*scheduler.log* savedsearch_name=*ACCELERATE* | dedup savedsearch_name host | table savedsearch_name host Kindly guide me on this. thanks in advance. ... View more

Hi Kamlesh, thanks for your effort on this when I execute the above query, I am getting some reports details with statistics count as 85, but how do I confirm whether they are configured as Accelerated Reports. And also I am getting some statistics count as 261 when I execute the below query. i`ndex=_internal source=*scheduler.log* savedsearch_name=*ACCELERATE* | dedup savedsearch_name host | table savedsearch_name host` Kindly guide me on this. thanks in advances. ... View more

Hi Somesoni2, thanks for your effort on this, hey props and transforms are placed in both indexer instances/ search head and inputs.conf is placed in the remote nodes. So I need to update it like this right in props.conf [linux_secure] EXTRACT-command = COMMAND\=(?.+)$ So shall I push the changes in both the indexer instance as well as search head master instances. Kindly guide me please. thanks in advance. ... View more

Hey micahkemp, thanks for your effort on this, I have updated the question with the Partial transforms.conf details. I am not sure how to make use of the code syntax to easier to read using 101010 button. Kindly guide me on how to parsing issue. thanks in advance. ... View more

Hi rphillips, thanks for your effort on this, Actually we are using common sourcetype configured in the inputs.conf for monitoring stanza then set the different sourcetypes via props/transforms by matching some regex. We have props.conf set as with TZ = UTC for all the paloalto devices that are reaching the syslogs servers. Details: inputs.conf [monitor:///opt/syslogs/paloalto/.../paloalto.log*] index=firewall sourcetype=paloalto:network:log host_segment = 4 Props.conf - Partial details not the entire props.conf [paloalto:network:log] category = Network & Security description = Output produced by the Palo Alto Networks Next-generation Firewall and Traps Endpoint Security Manager pulldown_type = true # This first line adjusts PAN-OS 6.1.0 threat logs to revised 6.1.1+ format where the reportid field is at the end. SEDCMD-6_1_0 = s/^((?:[^,]+,){3}THREAT,(?:[^,]*,){27}".*",[^,]*,)(\d+),((?:[^,]*,){3})(\d+,0x\d+,(?:[^,]*,){14})$/\1\3\4,\2/ SHOULD_LINEMERGE = false MAX_TIMESTAMP_LOOKAHEAD = 44 TRANSFORMS-sourcetype = pan_threat, pan_traffic, pan_system, pan_endpoint And we have other props.conf details configured for each sourcetype in the same props.conf file containing Field Aliases, Report-search etc which I have not posted in this comment. Transforms.conf details: sourcetype routing [pan_threat] DEST_KEY = MetaData:Sourcetype REGEX = ^[^,]+,[^,]+,[^,]+,THREAT, FORMAT = sourcetype::paloalto:network:threat [pan_traffic] DEST_KEY = MetaData:Sourcetype REGEX = ^[^,]+,[^,]+,[^,]+,TRAFFIC, FORMAT = sourcetype::paloalto:network:traffic [pan_system] DEST_KEY = MetaData:Sourcetype REGEX = ^[^,]+,[^,]+,[^,]+,SYSTEM, FORMAT = sourcetype::paloalto:network:system And apart from the above transform config details, we have Field extraction, Endpoint etraction, lookup are configure under transforms.conf which I have not posted here. Hey I could see that newly configured paloalto device data are reaching the sourcetype=sourcetype::paloalto:network:system but the data are intermediate. index=firewall host="test01pano.xxxx.com" source="/opt/syslogs/paloalto/test01pano.xxx.com/paloalto.log" sourcetype="paloalto:network:system" time frame = last 24 hours 12/12/17 11:04:11.000 PM Dec 13 04:04:11 test01pano.xxxx.com 1,2017/12/13 04:04:11,000702580900,SYSTEM,general,0,2017/12/13 04:04:11,,general,,0,0,general,informational,"Connection to Update server closed: updates.paloaltonetworks.com, source: 10.x.x.x",557,0x0,0,0,0,0,,test01pano Now we could see the data but its intermediate, kindly guide me on this. thanks in advance. ... View more