awesome - Thank You! ... View more

I am on Linux, I ran 'p's looking for splunkd and nothing running. I believe they did restart the server last night. I just checked and my root volume is out of space (at 99% used). Can that be the issue? ... View more

I did this, but not sure this is the best approach. "search index=_audit action=alert_fired earliest=startingDate latest=endingDate | map search=" |loadjob sid" I use a starting and ending date so I am only searching on a time frame when the alert happened and not the entire time frame. I am using the C# SDK, but is what you listed above a more efficient method? Thanks! ... View more

Thank You! ... View more

so I can continue to use the 6.6.2 UF on my windows 2008 r1 and r2 servers even though release notes for SPLUNK 7.0 indicate support is removed? ... View more

Thank You! ... View more

is backing up the full installation making a copy of $splunk_home/etc and all sub folders or does this include everything under $splunk_Home? ... View more

Thank You. ... View more

should this be done before I create the image or can it done as part of the install script? ... View more

Thank You, That worked. ... View more

I am using a light forwarder to send the log to the indexer, so I am guessing that is a intermediary? [hostoverride] REGEX = host=([a-zA-Z0-9.-_]+) DEST_KEY = MetaData:Host FORMAT = host::$1 [netwitness-extractions] REGEX = CEF:\d+|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])|([^|])| FORMAT = nullQueue sample Event: CEF: 1|RSA|Netwitness|10.6|severity=2|Executables|sessionid=94463671599|host=support.content.office.microsoft.com,support.content.office.microsoft.com|src=10.51.0.139|spt=59014|dst=23.36.68.96|dport=80|fname=AF102430631.wat,AF102430631.wat|dorg=Akamai Technologies|client=Microsoft ULS 15.0,Microsoft ULS 15.0 (Windows NT 6.1; Microsoft ULS 15.0.4669)|extension=wat,wat|server=Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0|service=80|threat=|username=|content=application/octet-stream,application/octet-stream|action=get,GET|zone=internet,internet|analysis.service=http1.1 without accept header,http1.1 without referer header,ssl certificate self-signed|analysis.session=0,ratio low transmitted,watchlist port,first carve,long connection,session size 10-50k,first carve not dns|analysis.file=exe filetype,exe two sections,exe filetype but not exe extension,small executable extension mismatch,small executable|filetype=windows executable,x86 pe,windows dll,signed executable|office=|device.host=|ioc=|boc=|eoc=|icf.category=| ... View more

I fixed the missing 'a'. I also checked my regex in regex101 and found that was not correct, I validated my regex finds the value. It is still not giving me host as I want it. 2 questions: 1. I do the transforms at the forwarder and not the indexer? 2. I have 2 transforms. First is the host over ride and the second is to parse the event as it is a custom CEF formatted string. Below is my props.conf for this index. [netwitness] FIELDALIAS-severity_as_id = severity as severity_id FIELDALIAS-dst_as_dest = dst as dest EVAL-app = netwitness EXTRACT-subject = CEF:\s+\d(?:|[^|]+){4}|(?[^|]+) EXTRACT-shost = CEF:\s+\d(?:|[^|]+){6}|+host=(?[a-zA-Z0-9.-_]+) TRANSFORMS-ho=hostoverride TRANSFORMS = netwitness-extractions ... View more

awesome, Thank You! ... View more

I get this stanza error: Undocumented key used in transforms.conf; stanza='hostoverride' setting='DEST_KEY' key='MetData:Host' Here is my transforms: [hostoverride] DEST_KEY = MetData:Host REGEX = CEF:\s+\d(?:|[^|]+)(6)|+host=([a-zA-Z0-9.-_]+) FORMAT = host::$1 ... View more