Make sure that when you are creating your inputs, that you are using distinct token names for each panel's input. ie. ...on the input for panel 1, use environment1 zone1 time1 ...on the input for panel 2, use environment2, zone2, time2 ...on the input for panel 3, use environment3, zone3, tme3 if the searches use the same token names, then the behavior would be as you described. ... View more

Chrome et all will post "site is not secured" when you have no SSL, or when your SSL certificate is not signed by a trusted CA or when your certificates are expired. So , to monitor for this, you need to have some mechanism open each of your web sites, parse the certificate that the web site is presenting into Splunk Indexes and then alert when the data is not as expected. The easiest way I can think of to do this would be to write a script that uses the openssl binaries to open your website. A one line example to get this data would be: # One liner CLI to get cert info from a web site: echo | openssl s_client -showcerts -servername website.domain.com -connect website.domain.com:443 2>/dev/null | openssl x509 -inform pem -noout -text When i run that against my Splunk server, i get output like the following: Certificate: Data: Version: 1 (0x0) Serial Number: 15712124552693347650 (0xda0cae08c5faf542) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=CA, L=San Francisco, O=Splunk, CN=Splunk CommonCA/[email protected] Validity Not Before: Dec 2 22:07:37 2016 GMT Not After : Dec 2 22:07:37 2019 GMT Subject: CN=SplunkServerDefaultCert, O=SplunkUser Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: 00:ba:a6:4e:0a:a2:1c:17:c0:b1:63:57:3d:0e:f2: 34:5c:82:21:ae:a1:d4:3c:3e:15:2c:8b:77:9c:c8: c2:92:d1:aa:05:e1:b7:8e:b8:a2:05:fa:6d:a4:0f: cc:fe:84:b4:75:eb:f2:3e:59:8f:15:85:84:de:81: b0:b2:bf:cf:a8:10:55:9c:d3:4a:4f:db:bc:e3:5c: d4:ce:74:af:96:fa:98:ec:81:be:76:aa:cb:9f:ba: 00:92:15:b0:a4:f1:5a:d0:c1:e2:52:10:ba:7c:2a: 33:36:c9:73:e3:c0:8f:1f:a8:79:dd:05:51:92:e3: 78:9c:fb:b4:b2:df:fd:be:f1 Exponent: 65537 (0x10001) Signature Algorithm: sha1WithRSAEncryption 32:09:ab:35:32:af:17:d2:ee:94:ef:ca:18:33:4c:bf:0e:a1: ea:f4:08:4f:c1:ff:ea:e4:3e:64:23:c7:f5:2d:46:11:83:4b: ec:70:99:c9:1f:fa:9d:53:50:c4:f0:a5:e8:f2:aa:f3:a4:11: c2:68:51:72:b1:67:de:86:86:69:96:f3:35:84:84:ca:99:dd: 67:e7:32:3a:ca:b6:3d:f0:77:b0:c7:25:f4:e0:35:2e:d5:79: 1d:50:38:45:b0:ad:c5:86:db:73:5f:63:82:05:8c:d8:7f:28: 45:2a:17:84:13:de:b5:f2:2e:07:dc:70:de:87:38:2b:ca:d2: 6e:fc so, if you create a shell script for each of your web sites, output the appropriate data from the script to index, you can then alert when the dates are close or expired, if the signing information is showing different than you expect or if the SSL is turned off for some reason. ...is this what you are looking for ... or did i miss the mark? ... View more

Have you tried rerunning the Winfra app setup procedure? that usually clears lookup errors like that. ... View more

Hi @akhil4mdev, On BLADE, run the following: /opt/splunk/bin/splunk btool server list --debug | egrep "(\[(clustering|shclustering)\]|pass4SymmKey\s+\=)" This will return something like the following: /opt/splunk/etc/apps/org_cluster_search_base/default/server.conf [clustering] /opt/splunk/etc/system/default/server.conf pass4SymmKey = /opt/splunk/etc/apps/org_cluster_search_base/local/server.conf pass4SymmKey = $1$t7/fkqNtX2XLT7JoAA== /opt/splunk/etc/system/default/server.conf pass4SymmKey = /opt/splunk/etc/system/default/server.conf [shclustering] /opt/splunk/etc/system/default/server.conf pass4SymmKey = Now, that error message is saying that one of either [clustering] or [shclustering] has not set a custom value. if you look at the example, i have a custom pass4SymmKey set on /opt/splunk/etc/apps/org_cluster_search_base/local/server.conf to set the value for [clustering], but for [shclustering], there is nothing other than the /etc/system/default value.... This one is the one that needs to be addressed. The value for pass4SymmKey needs to match on all the hosts in a cluster as well as the deployer / cluster master. ... View more

If you are looking to get rid of those messages altogether, you could use props / transforms to get rid of those events at index time... #props.conf [sourcetype-of-annoying-event] TRANSFORMS-get_rid_of_annoying_messages = shred_useless_cim_events #transforms.conf [shred_useless_cim_events] SOURCE_KEY = _raw DEST_KEY = queue FORMAT = nullQueue REGEX = Splunk_SA_CIM\sversion\s4\.11\.0\sis\slower\sthan\srequired\s4\.9\.1 ... These would need to be put on your indexers and / or heavy forwarders, depending on how data is coming into Splunk. ... View more

Hi There.. what about fixing the timestamp of the events that are missing the milliseconds using transforms to detect the space after seconds... then append .000 to it. props.conf [test_date_fix] disabled = false SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3n MAX_TIMESTAMP_LOOKAHEAD = 30 TRUNCATE = 10000 TRANSFORMS-01-FIXTIMESTAMP = fix_timestamp_missing_miliseconds transforms.conf [fix_timestamp_missing_miliseconds] disabled = false SOURCE_KEY = _raw DEST_KEY = _raw REGEX = ^(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})(\s.+) FORMAT = $1.000$2 C:\opt\test.log 2018-05-30 00:00:00.007 INFO Platea elementum vivamus scelerisque curabitur te 2018-05-30 00:00:00.144 INFO Nulla tellus blandit erat semper turpis aliquet m 2018-05-30 00:00:00.277 INFO Ipsum ultrices cras dictumst aenean proin, litora 2018-05-30 00:00:00.301 INFO At nam tempor nec quis sem augue placerat suspend 2018-05-30 00:00:00.560 INFO Nec massa auctor nibh tellus conubia a lacus, nam 2018-05-30 00:00:00.701 INFO id pulvinar tempus massa cubilia curabitur at pri 2018-05-30 00:00:00.801 INFO Platea elementum vivamus scelerisque curabitur te 2018-05-30 00:00:00 INFO Nulla tellus blandit erat semper turpis aliquet m 2018-05-30 00:00:01.008 INFO Ipsum ultrices cras dictumst aenean proin, litora 2018-05-30 00:00:01.012 INFO At nam tempor nec quis sem augue placerat suspend 2018-05-30 00:00:01.210 INFO Nec massa auctor nibh tellus conubia a lacus, nam 2018-05-30 00:00:01.240 INFO id pulvinar tempus massa cubilia curabitur at pri 2018-05-30 00:00:01.360 INFO Platea elementum vivamus scelerisque curabitur te 2018-05-30 00:00:01.373 INFO Nulla tellus blandit erat semper turpis aliquet m 2018-05-30 00:00:01 INFO Ipsum ultrices cras dictumst aenean proin, litora search: index=main sourcetype=test_date_fix | table _raw _raw 2018-05-30 00:00:01.000 INFO Ipsum ultrices cras dictumst aenean proin, li 2018-05-30 00:00:01.373 INFO Nulla tellus blandit erat semper turpis aliquet m 2018-05-30 00:00:01.360 INFO Platea elementum vivamus scelerisque curabitur te 2018-05-30 00:00:01.240 INFO id pulvinar tempus massa cubilia curabitur at pri 2018-05-30 00:00:01.210 INFO Nec massa auctor nibh tellus conubia a lacus, nam 2018-05-30 00:00:01.012 INFO At nam tempor nec quis sem augue placerat suspend 2018-05-30 00:00:01.008 INFO Ipsum ultrices cras dictumst aenean proin, litora 2018-05-30 00:00:00.000 INFO Nulla tellus blandit erat semper turpis aliqu 2018-05-30 00:00:00.801 INFO Platea elementum vivamus scelerisque curabitur te 2018-05-30 00:00:00.701 INFO id pulvinar tempus massa cubilia curabitur at pri 2018-05-30 00:00:00.560 INFO Nec massa auctor nibh tellus conubia a lacus, nam 2018-05-30 00:00:00.301 INFO At nam tempor nec quis sem augue placerat suspend 2018-05-30 00:00:00.277 INFO Ipsum ultrices cras dictumst aenean proin, litora 2018-05-30 00:00:00.144 INFO Nulla tellus blandit erat semper turpis aliquet m 2018-05-30 00:00:00.007 INFO Platea elementum vivamus scelerisque curabitur te ... View more

Can't think of a way to do it in a single pass, but this works: | makeresults | eval data="Jûán Pérëz Ä Žîs Çópú Ö'ñó", origdata=data | rex field="data" mode=sed "s/[ÀÁÂÃÄ]/A/g" | rex field="data" mode=sed "s/[Ç]/C/g" | rex field="data" mode=sed "s/[ÈÉÊË]/E/g" | rex field="data" mode=sed "s/[Ñ]/N/g" | rex field="data" mode=sed "s/[ÒÓÔÕÖ]/O/g" | rex field="data" mode=sed "s/[Š]/S/g" | rex field="data" mode=sed "s/[ÙÚÛÜ]/U/g" | rex field="data" mode=sed "s/[ÝŸ]/Y/g" | rex field="data" mode=sed "s/[Ž]/Z/g" | rex field="data" mode=sed "s/[àáâãäª]/a/g" | rex field="data" mode=sed "s/[ç]/c/g" | rex field="data" mode=sed "s/[èéêë]/e/g" | rex field="data" mode=sed "s/[ìíîï]/i/g" | rex field="data" mode=sed "s/[ñ]/n/g" | rex field="data" mode=sed "s/[òóôöõº]/o/g" | rex field="data" mode=sed "s/[ùúûü]/u/g" | rex field="data" mode=sed "s/[ýÿ]/y/g" | rex field="data" mode=sed "s/[š]/s/g" | rex field="data" mode=sed "s/[ž]/z/g" Output: _time 2018-05-28 13:52:34 origdata Jûán Pérëz Ä Žîs Çópú Ö'ñó data Juan Perez A Zis Copu O'no ... View more

on my Splunk 6.5.1 Linux box, users.ini is empty: 0 -r--r--r--. 1 splunk splunk 0 Nov 18 2016 users.ini ... View more

(and which version/OS are we talking about? ... View more

same version/edition of Splunk on both? ... View more

go to a fresh Splunk instance, copy /opt/splunk/etc/users/users.ini from the fresh instance to yours, be sure to keep the file modified times ... restart. this will go away ... View more

Not enough information to proceed. What operating system is your local computer? What operating system is the remote computer? What is the network between them? Internet? Company WAN? Where is there a forwarder installed? local computer? remote computer? Where is Splunk installed...? is that on the local computer? ... View more

Hi Matthew, I think you are asking for a way to include the hostname in the field names... I would think there's a better way to do that on the fly rather than trying to extract a tonne of fields with the hostname hard coded...that makes future homework as servers are added/decommissioned... who wants to miss monitoring on the new server because poor overworked Matthew forgot to add the new server to the list... What about something like this: start with this as a set of base data to illustrate the point: | makeresults | eval data="1507063392.123,was01,17,18,19,20|1507063394.345,was01,21,22,23,24|1507063396.567,was02,25,26,27,28" | makemv delim="|" data | mvexpand data | rex field=data "^(?<_time>[^\,]+)\,(?<host>[^\,]+)\,(?<datapoint1>\d+)\,(?<datapoint2>\d+)\,(?<datapoint3>\d+)\,(?<datapoint4>\d+)" | table _time host datapoint* so i have multiple data points for each host... like so: _time host datapoint1 datapoint2 datapoint3 datapoint4 2017-10-03 16:43:12.123 was01 17 18 19 20 2017-10-03 16:43:14.345 was01 21 22 23 24 2017-10-03 16:43:16.567 was02 25 26 27 28 From your question, I read that you want to get each datapoint1 value to be hostname-datapoint1 So to make that happen, do this: | makeresults | eval data="1507063392.123,was01,17,18,19,20|1507063394.345,was01,21,22,23,24|1507063396.567,was02,25,26,27,28" | makemv delim="|" data | mvexpand data | rex field=data "^(?<_time>[^\,]+)\,(?<host>[^\,]+)\,(?<datapoint1>\d+)\,(?<datapoint2>\d+)\,(?<datapoint3>\d+)\,(?<datapoint4>\d+)" | table _time host datapoint* | eval measurename=host+"-datapoint1" | fields + _time measurename datapoint1 | chart avg(datapoint1) by measurename Which outputs...: measurename AVG ---------------- --- was01-datapoint1 19 was02-datapoint1 25 ... View more

OK... I took a deeper look at the app and you're correct, something doesn't jive. eventtypes has this: [cylance_index] search = index=protect OR index=cylance_protect [protect_alert] priority = 5 search = eventtype=cylance_index sourcetype=audit_log [protect_malware] priority = 5 search = eventtype=cylance_index (sourcetype=console_syslog AND EventType=Threat) OR sourcetype=threat OR sourcetype=exploit [protect_inventory] priority = 5 search = eventtype=cylance_index (sourcetype=console_syslog AND EventType=Device) OR sourcetype=device on each of the protect_* searches, it has all of them looking at sourcetype=console_syslog, with eventtype, or looking at (exploit|device) by themselves.. not looking at syslog_exploit or syslog_device.. etc. you're gonna have to do some minor surgery to fix this,. (Be a peach & advise the dev as well. ) ... View more

Not a bug.. look in the props.conf entry for syslog_protect sourcetype for example... [syslog_protect] TRANSFORMS-changesourcetype = set_auditlog_sourcetype TRANSFORMS-changesourcetype2 = set_threatclassification_sourcetype TRANSFORMS-changesourcetype3 = set_exploit_sourcetype TRANSFORMS-changesourcetype4 = set_appcontrol_sourcetype TRANSFORMS-changesourcetype5 = set_threat_sourcetype TRANSFORMS-changesourcetype6 = set_device_sourcetype TRANSFORMS-changesourcetype7 = set_devicecontrol_sourcetype TRANSFORMS-changesourcetype8 = set_scriptcontrol_sourcetype looking in the transforms.conf... set_auditlog_sourcetype looks like this: [set_auditlog_sourcetype] REGEX = Event\sType:\s+AuditLog FORMAT = sourcetype::syslog_audit_log DEST_KEY = MetaData:Sourcetype So , they reroute the syslog_* sourcetypes to others based on regex matching. ... View more

In dbx, both source and sourcetype are free text fields which will accept pretty much any value. Along with index, they give a three pronged pointer to find dbx sourced data. In search, if you can't find your data using index= source= sourcetype= Then try: index=_internal sourcetype=dbx* And see what kind of errors are being raised by your input. ... View more

First off, I am guessing you mean a Forwarder, Indexer and Search Head.. What are you looking for help with? Sizing for the VMs? ... View more

So couldn't you add the user name to that lookup? That way the lookup will have one line for each user. The lookup acts as your cookies. ... View more

Since "search-head-clustering" is one of your tags I'm gonna guess that you are... The reason that everything is default is because you are on a SHC. The SHC is setup with 3 or more search heads and then a Deployer node, which handles configuration management for the cluster nodes. The way that Splunk has engineered this, to make sure that changes made in the UI on your SHs are not overwritten by confs from the deployer, is that the deployer takes default and local configs and flattens them into default (after following standard splunk config precedence rules) As a rule of thumb, on a SHC SH default is managed by the deployer and local is managed by user activity. So....how can you delete things? Have whomever is responsible for managing the deployer delete the configs there. ... View more