Hello, all! Maybe someone has set up tracking bash_history file from all users in /home/*/.bash_history I experimented with fschange, but splunkforwarder don't send data to server. Splunk user can access to read .bash_history files. Can anybody help me with this question? Thanks! ... View more

Hello, all. Have a news about 6.6.0 but i can't download it. Nothing in installation package list. Any body know what is this? Thanks. ... View more

Hello, all 🙂 I have a new request for help. First time a use next request for every table: Input Type: Advansed SELECT RecordId,CompId,UserId,EventId,Type,ProcessName,Pid,DeviceTypeId,Action,Name,Info,AdditionDate,Reason,ReasonMnemonic,DeviceType FROM "DevicelockDB"."dbo"."DLAuditLog" Column_list WHERE RecordId > ? ORDER BY RecordId ASC Checkpoint Column RecordId and value. But now, i want use full request with all interesting data from database. I creat a request but can't get the following query to work: SELECT AdditionDate,DLAuditLog.RecordId AS record_ID,DLUsers.UserName,DLStations.NetworkAddr,DLAuditLog.ProcessName,DLAuditLog.Action,DLAuditLog.Name,DLShadowFiles.OriginalFileName,DLAuditLog.DeviceType,DLAuditLog.Reason,DLAuditLog.ReasonMnemonic,DLAuditLog.Info,DLAuditLog.CompId AS compID_1,DLAuditLog.UserId AS userID_1,DLAuditLog.EventId,DLAuditLog.Type,DLAuditLog.Pid,DLAuditLog.DeviceTypeId,DLUsers.UserId AS userID_2,DLStations.CompId AS compID_2,DLShadowFiles_Users.UserId AS userID_3,DLShadowFiles_Users.ShadowId AS shadow_1,DLShadowFiles.ShadowId AS shadow_2 FROM DLAuditLog INNER JOIN DLUsers ON DLUsers.UserId = DLAuditLog.UserId INNER JOIN DLStations ON DLStations.CompId = DLAuditLog.CompId INNER JOIN DLShadowFiles_Users ON DLShadowFiles_Users.UserId = DLAuditLog.UserId INNER JOIN DLShadowFiles ON DLShadowFiles.ShadowId = DLShadowFiles_Users.ShadowId ORDER BY RecordId,compID_2,NetworkAddr,userID_2,userID_3,shadow_2,OriginalFileName,UserName,EventId,Type,ProcessName,Pid,DeviceTypeId,Action,Name,Info,AdditionDate,Reason,ReasonMnemonic,DeviceType Maybe anyone can help with that, i want use this request in splunk db connect and follow data based on RecordId field, only new event write to splunk base. Thanks! ... View more

Hello all. Have a trouble with configure DB inputs with using Checkpoint column. Maybe you can solve my trouble? SQL: SELECT * FROM "myDB"."dbo"."myDBAuditLog" where [RecordId] BETWEEN (select max([RecordId]) from "myDB"."dbo"."muDBAuditLog") - 10 AND (select max([RecordId]) from "myDB"."dbo"."myDBAuditLog") In a result, i have column RecordId and i want using it for download to Splunk only new strings. But i can't understand what i must write in Checkpoint Value? Thanks. ... View more

Hello, all. I know that my question's not a unique, but I want to ask it 🙂 I have a netflow text log on a server with a universal forwarder installed. I don't want to index this entire log. I only want to index fields containing a certain key. For example, I can provide a few strings: {"timestamp":"2016-11-22T15:42:17.037821+0300","flow_id":268878859621513,"event_type":"netflow","src_ip":"11.11.11.11","src_port":22,"dest_ip":"22.22.22.22","dest_port":44206,"proto":"TCP","app_proto":"ssh","netflow":{"pkts":8,"bytes":2230,"start":"2016-11-22T15:41:14.611465+0300","end":"2016-11-22T15:41:14.638311+0300","age":0},"tcp":{"tcp_flags":"1a","syn":true,"psh":true,"ack":true}} {"timestamp":"2016-11-22T15:44:18.013133+0300","flow_id":720902685008782,"event_type":"netflow","src_ip":"157.55.130.156","src_port":40032,"dest_ip":"22.22.22.22","dest_port":3166,"proto":"UDP","netflow":{"pkts":2,"bytes":126,"start":"2016-11-22T15:39:17.402318+0300","end":"2016-11-22T15:39:17.527073+0300","age":0}} {"timestamp":"2016-11-22T15:44:16.025489+0300","flow_id":265292561318767,"event_type":"netflow","src_ip":"22.22.22.22","src_port":41979,"dest_ip":"33.33.33.33","dest_port":443,"proto":"TCP","app_proto":"tls","netflow":{"pkts":40,"bytes":14432,"start":"2016-11-22T15:41:05.983919+0300","end":"2016-11-22T15:43:14.286741+0300","age":129},"tcp":{"tcp_flags":"1b","syn":true,"fin":true,"psh":true,"ack":true}} As you can see, we have a different field - proto and app_proto. I only want to index data with these specific fields in Splunk. For example, I only need events with proto":"TCP", or maybe proto":"TCP" and (or) app_proto":"ssh" Can you help my with this case? I read the manual, but I can't understand the principle of the implementation of this. Thanks! ... View more

Hello all. We have a little trouble with our license. We paid for a new license and are waiting for a new file at the moment. But our current license is expired this morning and now i have a message in license manager, "Correct by midnight to avoid violation". And i understand that a new license i can't be installed before this time. What can you advise in this case? Turn off the server, or temporarily stop collecting logs to not get an error exceeding the license? Question is urgent 🙂 Thanks. ... View more

Hello, We use splunk db connect v2 to connect to encrypted DB. In order to obtain the decrypted data is necessary to open the session with command: OPEN SYMMETRIC KEY DLKey DECRYPTION BY CERTIFICATE DLCertificate But i can't understand where i must place this command. Can you help me? Thanks! ... View more