Agents for old versions of windows. I have a client which has some devices with versions of windows 2012 and 2008 On the agent download splunk page there is a link where previous versions can be found When I enter this link I see that there are some agents for these versions of windows My question is why the first column shows a version of splunk, and I don't know if that agent only works for that version of splunk enterprise?     ... View more

I have an index called firewall and sourcetypes of Palo Alto, Checkpoint and Fortinet routers The configuration was carried out according to the documentation recommendations regarding recommended sourcertype and Add-on according to the vendor The "action" type fields that are accepted have different names depending on the brand of the device Those that are accepted are: allowed accept Authorize pass Taking into account that "accept" and "allowed" mean the same thing, should I normalize them? or as they are already recognized by the correlation events that Splunk ES has created? ... View more

I need to reject or not index the logs that have the word "notice" inside the log I understand that it is done using these two files I have 2 doubts: 1. Is the regex ok? 2. If the path is constantly changing I can use a wildcard? [source::/folder/folder/logs/firewall-xxxxx/* ] props.conf [source::/folder/folder/logs/firewall-xxxxx/2020/12/4/local7.log] TRANSFORMS-null= setnull transforms.conf [setnull] REGEX = notice DEST_KEY = queue FORMAT = nullQueue Sample Log date=2019-05-10 time=11:37:47 logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" eventtime=1557513467369913239 srcip=10.1.100.11 srcport=58012 srcintf="port12" srcintfrole="undefined" dstip=23.59.154.35 dstport=80 dstintf="port11" dstintfrole="undefined" srcuuid="ae28f494-5735-51e9-f247-d1d2ce663f4b" dstuuid="ae28f494-5735-51e9-f247-d1d2ce663f4b" poluuid="ccb269e0-5735-51e9-a218-a397dd08b7eb" sessionid=105048 proto=6 action="close" policyid=1 policytype="policy" service="HTTP" dstcountry="Canada" srccountry="Reserved" trandisp="snat" transip=172.16.200.2 transport=58012 appid=34050 app="HTTP.BROWSER_Firefox" appcat="Web.Client" apprisk="elevated" applist="g-default" duration=116 sentbyte=1188 rcvdbyte=1224 sentpkt=17 rcvdpkt=16 utmaction="allow" countapp=1 osname="Ubuntu" mastersrcmac="a2:e9:00:ec:40:01" srcmac="a2:e9:00:ec:40:01" srcserver=0 utmref=65500-742       ... View more

I need that the "notice" type logs are not forwarded to the indexer I know I should add a line called "blacklist" but I'm not good with regular expressions Another question, why in some threads they talk about modifying the file "props.conf" and "transforms.conf" what is the difference between doing it from inputs.conf and the other way? inputs.log [monitor:///folder/folder/folder/ip_firewall] disabled = false host = namefirewall index = firewalls sourcetype = fgt_log Sample Log date=2019-05-10 time=11:37:47 logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" eventtime=1557513467369913239 srcip=10.1.100.11 srcport=58012 srcintf="port12" srcintfrole="undefined" dstip=23.59.154.35 dstport=80 dstintf="port11" dstintfrole="undefined" srcuuid="ae28f494-5735-51e9-f247-d1d2ce663f4b" dstuuid="ae28f494-5735-51e9-f247-d1d2ce663f4b" poluuid="ccb269e0-5735-51e9-a218-a397dd08b7eb" sessionid=105048 proto=6 action="close" policyid=1 policytype="policy" service="HTTP" dstcountry="Canada" srccountry="Reserved" trandisp="snat" transip=172.16.200.2 transport=58012 appid=34050 app="HTTP.BROWSER_Firefox" appcat="Web.Client" apprisk="elevated" applist="g-default" duration=116 sentbyte=1188 rcvdbyte=1224 sentpkt=17 rcvdpkt=16 utmaction="allow" countapp=1 osname="Ubuntu" mastersrcmac="a2:e9:00:ec:40:01" srcmac="a2:e9:00:ec:40:01" srcserver=0 utmref=65500-742 ... View more

I understand that I should obtain results if I also consult only specifying the sourcetype and the rest of the search criteria, but I don't know why it does not bring results, how could I solve it? there are results index = myindex sourcetype = my sourcetype  no results sourcetype = my sourcetype  ... View more

  I have a route that has all the logs, but in it there are several types of logs, I only need some that start with a certain name. Apple banana mango dns.log dns_1123.log dns3_1.log if I need the log that starts with dns and ends in anything else I understand that I can use dns * [monitor:///folder1/folder2/folder3/folder/logs/dns*] disabled = false host = 10.10.10.10 index = myindex sourcetype = mysourcetype   But when I check the logs that are being indexed, all the logs are arriving, even the ones that I don't need, how else can I make only the ones that start with dns arrive and not the other logs? ... View more