Where am i going wrong here: I'm trying to get a list of user ID's by location and pass them up to a search which also uses the userID field and then get the average UIdelay metric of those users which only appears in the UIDelay sourcetype? Is this the most efficient way when the result set of the subsearch is around 1k ? 'index=test sourcetype=UIDelay UIDelayMs=* [ search index=test sourcetype=Session Name="Roma" | stats count by SessionGUID | dedup SessionGUID | fields SessionGUID] | stats avg(UIDelayMs) ' gratzi Edit I got it working but is it the most effiecient if its to be run every 5mins ? (over the last 5mins) ? ... View more

Looking to do a search which shows start time and end time when _raw events were 0 over a say 24hr period. Trying to find out when and how often my events drop to 0 for specific hosts gratzi ... View more

I'm getting data that drops off daily for a series of hosts on a daily basis. One group is in singapore and another in Manilla Where would you start to troubleshoot this ? gratzi ... View more

I am using the license usage app and i have usage being shown for indexes that arent on the system. If i click on the index (listed in the license usage app) i'm taken to the following search (below) - what is this telling me ? series is the non-existant index name. index="_internal" source="*metrics.log" per_index_thruput series=devices usually if i am receiving events for an index that doesn't exist then it shows in splunk messages. To resolve this will adding the relevant index (devices) start it populating ? ... View more

I have a base search as such : index=windows host=specific_hosts* Type=Service Name=servicename | eval Service_Running=if(State="Running",1,0) every 5 mins last 5 mins split by ent = Y filter to entities in service entity lookup = host Then I have created a metric Title = Service Running Threshold Field = Service_Running Entity Calculation latest Service Calculation latest This gives me a 1 charting nicely in the Aggregate Threshold Values and I've set a threshold of 1 normal 0 critical However, I get N/A in the KPI's for all of these hosts? gratzi ... View more

Having used DS to deploy some apps to a SH in a small env - i now want to remove these and deploy as standard - but which is the best procedure to do this? edit > uninstall app from DS (app directory will be removed from SH ?) remove app from DS - deployment-app directory re-install app manually on SH anything else ? gratzi. ... View more

I have a report which is sloooow - seems like a good candidate for summary index. reading the docs it suggests configuring a saved search to run on an hourly basis to populate the previous hours data. This dashboard panel will then show a months web transactions. but how to set this up initially .. should i create a scheduled saved search to initially run over a month timeframe to initially populate the summary index - and then reconfigure to run hourly - or what ? gratzi. ... View more

could this tool be used to capture a number of key routes and baseline number of hops and rtt time and alert if number of hops increase - or if rtt ttime increases over threshlod or SLA ? gratzi ... View more

Ive install syslog-ng on a standalone splunk instance but cannot get it running - ive looked at the following guide : https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html using a syslog gen i can send a message directly to splunk as a direct input, but then i disable that and configure syslog-ng. the service starts and is listening but nothing is written to a file [root@centos-6-1 syslog-ng]# netstat -anp | grep 514 udp 0 0 0.0.0.0:514 0.0.0.0:* 13833/syslog-ng sending a facility 7 syslog message from cmd line: SyslogGen.exe -t:x.x.x.x -f:7 -s:7 -h:myhost -m:"Too many bytes.\x0D\x0A" @version:3.2 syslog-ng configuration file. This should behave pretty much like the original syslog on RedHat. But it could be configured a lot smarter. See syslog-ng(8) and syslog-ng.conf(5) for more information. options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { udp(port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/opt/syslog-ng/$HOST/$YEAR-$MONTH-$DAY-test.log"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/opt/syslog-ng/$HOST/$YEAR-$MONTH-$DAY-test1.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; vim:ft=syslog-ng:ai:si:ts=4:sw=4:et: gratzi ... View more

I have Splunk sitting on a standalone box with hostname "splunk" I am testing triggering alerts to a third party app. When the alert triggers it sends the host value "Splunk" to the third party app. I want to be able to change this field to "splunk.domain.org" so that we can launch back into splunk in context from a link that's presented on the third party app as currently http://splunk when I'd like it to be http://splunk.domain.org... I've tried setting the splunk hostname and tried a few props.conf settings but haven't been able to succeed as yet. gratzi ... View more

allo, I have inherited a scenario of 1 x SH, 1 DS, 1 IDX, 1HF The SH has an instance of ES installed. I'm looking at moving the hot\warm buckets to the SSD drive and leaving the cold\frozen in the old location. the indexer.confs seem spread out across the deployment and found most of them defined in the ../etc/apps/search/local/indexes.conf To try and tidy this up a bit would you recommend creating a new app on the DS and copying the /etc/apps/search/local/indexes.conf to the new app (index_master), making my changes to point the hot\warm to the new location and deploying it to the IDX creating an index master config ? ** also aware of manually copying the files across ** Are there any other possible conflicting considerations with the Splunk_TA_ForIndexers app which is also installed on the IDX and has a series of indexes defined ? have seen the article here also https://answers.splunk.com/answers/368098/splunk-enterprise-security-requires-a-deployment-c.html gratzi ... View more

I have read this article which describes searching for high or critical notable events. https://answers.splunk.com/answers/432018/splunk-enterprise-security-how-to-set-up-alerts-wh.html notable | where urgency="high" OR urgency="critical" | table _time source src dest user | eval computer=coalesce(src,dest) Now i need a simple way to create a critical notable event to test. How best to achieve this ? gratzi ... View more

IF an error is made when creating a correlation search - like using the wrong app context, and you'd like to remove that search and re-apply it. What are the steps pls ? Found a couple of answer posts referring this but they are quite old and list nothing stepwise. gratzi ... View more