Hi, I have a search as a dashboard panel. When I execute the search on the dashboard, the result is incorrect. What's interesting is: If I refresh the panel, the result is still incorrect when I 'open the search' from the dashboard panel, it's still incorrect When hit the search button after the 'open the search' the result is correct. Unfortunately, I can't post up the search. Notes: At no stage was the search changed The time selector was not changed The search was working in Splunk <6.3.0 If I dissect the search, the individual components return the expected result I'd be interested as to what I can do to check to see where the problem could be. ... View more

Hi, I'm currently using the expensive transaction command to keep transactions without any duplicates. So if I had a b c c d d d this would return a b sourcetype... | transaction name keepevicted=true | search eventcount=1 I'm trying to use: search sourcetype=... | streamstats count by name Which will give me a new field 'count' however I can't use where count&gt;1 as one of the duplicates still remain. I've hit a mental block, any ideas? Can't use dedup for the same problem, one instance will still remain. Thanks in advance. ... View more

Hi, Splunk Add-on for Sophos is working well, however, I'm not sure if it's extracting all the fields. Using this as an example: InsertedAt=2015-09-03 14:40:05; EventID=xxxxx; EventTime=2015-09-03 13:21:21; ActionID=101; Action=None; UserName=xxx\xxx; ScanTypeID=200; ScanType=Unknown; StatusID=300; Status=Cleanable; EventTypeID=2; EventType=Adware or PUA; EventName=xxxx; FullFilePath=C:\path\filename.exe; ComputerName=xxx; ComputerDomain=xxx; ComputerIPAddress=x.x.x.x Looking in transforms.conf for the Splunk Add-on, the stanza reads: [sophos_threat_file_path_and_file_name] REGEX = FullFilePath=\"(.+?)\\([^\\]+?)\"\; FORMAT = file_path::$1 file_name::$2 FullFilePath is then separated into file_path and file_name, however there are two issues: 1. Path extractions do not seem to work (does not appear to split into file_path, file_name, could be the missing double quotes in the event?) 2. Sophos also conducts memory scans and uses FullFilePath to state this as 'User Memory' The same problem is happening for the event time, there's no double quote in the event: TIME_PREFIX = EventTime=" Is there a way to test if this is actually working? ... View more

Hi All, Is there any way to assign a 'variable' to a role? We're creating a dashboard for many sites (15+) which will show their local information. The idea is that they would log in and get their local dashboard based on role. Notes: The dashboard is written in Advanced XML with macros to centralise the queries. We're avoiding using variables in the URL to avoid the site looking up other sites' details. We'd like to package it up as an app to allow for change control, deployment, etc (we can decentralise the queries quite easily) Thanks in advance. ... View more

All, Trying to set up CSC for firewalls but using a local log file as opposed to syslog (it's a proof of concept and we don't want to change FW configs, etc just yet) What is done so far: Installed CSC and Splunk for Cisco firewalls Created a inputs.conf in the Cisco FW app directory ie: splunk_ciscofirewalls\local: [monitor://C:\Firewall\*cisco] disabled=false restarted splunk Splunk grabs the file without issue but the sourcetypes do not appear (not applying the transforms). Note: we deliberately omitted the sourcetype as we want the app to assign the events to the respective source type as per: http://wiki.splunk.com/Set_up_Splunk_for_Cisco_Firewalls 'Do not specify a source type. The Splunk for Cisco Firewalls add-on automatically assigns source types for your Cisco ASA, FWSM, and PIX firewall events as cisco_asa, cisco_fwsm, and cisco_pix, accordingly. Questions: Is this possible to do without setting up syslog (I would imagine the answer is yes)? Has anyone set this up successfully? Is there a step missing? ... View more