Then you need to adjust your search to select only the events you want to see (or remove those you don't want to see). For example, 'sourcetype="WinEventLog:Security" LogName="Security" | ...' ... View more

Include the sourcetype in your search statement. For example: sourcetype="WinEventLog:Security" "EventCode" | ... ... View more

You have to specify the key column of the table being updated. ... notFound=INSERT key=Name Name Age Sex Phone ... View more

Try '... | stats sum(hit_count) by src_ip,signature as hits | ...' ... View more

Perhaps something like this? sourcetype="IDS" | transaction src_ip signature | stats sum(hit_count) by src_ip as hits | table src_ip signature hits | sort -hits ... View more

Please accept this answer if it solves your problem. ... View more

I got good results with this regex string (?i).+phonehome.+8089_(.+_)?(?P<fieldname>.+?)_ A helpful site for testing regex strings is RegexPlanet. ... View more

halr9000, see my existing question at http://answers.splunk.com/answers/105439/no-port_scan-data ... View more

Rex is pretty simple once you get the hang of it. Try something like this: ... | rex field=_raw "(?<arg1>.*?)\s(?<arg2>.*?)\s(?<arg3>.*?) Deny TCP reverse path check from (?<From>.*?) to (?<To>.*?) on interface (?<interface>.*?)" | dedup From, To | table From, To Someone else may have a more elegant solution. ... View more

I'm having a similar problem with the Asset Discovery app. It appears Splunk 6 does not come with the right OpenSSL library. ... View more

Perhaps it's copy-and-paste error, but it looks like you're missing a tag. ... View more

[script://./bin/nmap.sh] disabled = 0 [script://./bin/nmap.sh -A -O] disabled = 0 [script:///opt/splunk/etc/apps/asset_discovery/bin/nmap.sh -p14147 -t 172.16.42. 64 172.16.42.220 172.16.42.230] disabled = false index = asset_discovery interval = 60 source = nmap sourcetype = port_scan ... View more

I restarted Splunk and still am getting no port_scan data. In fact, my asset_discovery index contains nothing at all. ... View more

Try ' eventcount index=* summarize=false NOT (index=main OR index=summary OR index=history) ' ... View more

I made the same changes and still no data. Did you have to restart Splunk? ... View more

Splunk 6 was installed fresh. I then copied our app from our Splunk 5 system and installed the following apps: Splunk Add-on for *Nix, Asset Discovery, Splunk DB Connect, Splunk + OData, Sideview Utils, S.o.S, Splunk App for Unix, Deployment Monitor, Tenable Security Center. I swear I grepped for 'IPLookup' before I posted this question and didn't find it. This time I did find it. The lookup was an old experiment that didn't go anywhere. I've commented it out of props.conf. We do not see this error on our Splunk 5 system. ... View more

How about narrowing your search to the last 2 minutes and setting an alert if there are no results? ... View more

Try adding ' | table DC, Version, Pageviews, "95th% RTT" ' to the end of your search. ... View more

Please mark my answer as accepted. ... View more

Have you tried | eval ts=strftime(_time, "%m/%d/%y %H:%M %p") ? ... View more