What version of Splunk search head are you using. I am seeing different behavior from one version to the next. ... View more

On my 6.2.1 search head, the following is the best I could do. It needs a bit of cleaning up, but the gist is there: (eventtype=splunk_access tag=authentication) OR (((index=_internal UiAuth) OR (index=_internal sourcetype=splunk_web_service)) action=login OR action=logout) user=* | table _time, action, user, clientip, status I can't seem to find the client ip for any successful commands. That worries me. Once a user does searches, the client ip does get logged, however. I haven't yet checked to see if this captures SDK connections as well. ... View more

Did you try something like: index=snare |field - Mar_* | fieldsummary | table field Also, it may help to add a cluster command in the middle to reduce the load. index=snare |fields - Mar_* | cluster | fields - cluster_* | fieldsummary | table field ... View more

I remembered that I could also do it with routing from outputs.conf: [tcpout] defaultGroup = default-autolb-group forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = (_audit|_internal) We have an upgrade plan, but it will take a bit longer. - thanks ... View more

Your search would be simpler and more efficient if you started it with: index=proxysg sourcetype=proxysg Category="IBC Allow*" Then the subsequent search would not be necessary. It's not clear to me exactly what you are trying to do. ... View more

To upload a lookup file, you can follow the instructions here: http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Usefieldlookups#Upload_the_lookup_table_file Is your field srcip or src_ip (with an underscore)? In the later case, follow lguinn's instructions along with the above docs. ... View more

The CSV input file or lookup file as lguinn suggested are the way to go. If you cannot use either of those approaches, then searching for srcip in a large set should be done at the front of the search. You also have to put OR conditions in parenthesis. Something like: index=DEVICE (srcip=IP1 OR srcip=IP2 OR ... OR srcip=IP500) The dedup command requires another pipe | as follows: index=DEVICE (srcip=IP1 OR ...) | dedup srcip To put the results in a table, you need to add the table command: index=DEVICE (srcip=IP1 OR ...) | dedup srcip | table srcip ... View more

index=DEVICE |dedup srcip |... will eliminate duplicate IPs. As to the searching for a big list of addresses, you want to look into "lookup" tables or "input CSV" files. By the way, you can use CIDR blocks in the search, lookup file or input CSV file. You can create an input CSV file by putting a file in the: $SPLUNK_HOME/var/run/splunk/ folder and call it something like myips.csv. The first line of the file should be srcip and each line after that can be an IP address. Then you can limit your search as follows: index=DEVICE [|inputcsv "myips.csv"] | dedup srcip | table srcip This will give you a list of the srcip entries that matched those in the file and only print one of each. You can do something in the reverse to find those that are missing from your file: |inputcsv "myips.csv" NOT [index=DEVICE |dedup srcip|fields srcip] This last search will work for a small time range, but the subsearch may time out on longer ones. A more complete solution to that is a bit more involved, but can be done. ... View more

This is a great solution to the problem, so I gave it the check! I would still like to see a native solution from Splunk, however. For example, I might want to do something like the following to comment pieces of a SPL. (similar to C-style) | timechart \/*limit=20*\/ limit=5 span=\/*5m*\/10m count by sourcetype ... View more

Create an alert script in $SPLUNK_HOME/bin/scripts/call_bmc.py or any other scripting language that you are familiar with. When you alert on a rule, have it execute the script (just call_bmc.py or whatever you call it). The 8th parameter passed to the script will be a file containing the results of the search. You can open and read this file from the script. See: Configuring Alerts for information about how the script is initiated. I would create search macros that add columns or rows to your search that could give instructions to the script. You may also want to make the script intelligent with a config file and some kind of alerting language (extra credit). If it's good, post it as an app to Splunkbase 🙂 ... View more

Also look at index=_internal component=LicenseUsage. You can aggregate on s (source), st (sourcetype), h (host) and i (indexer). The field b is bytes. This must be done from the License Manager or where ever those logs are made available. ... View more

The backslash before the "d{5}" didn't get rendered. I have edited my answer to fix that. It should be "\d{5}" ... View more

Also, did you try the TDS driver. It can do Integrated Security as well and may be better written. ... View more

Could it have been a java memory problem? What did you have for -Xmx in the java bridge options? ... View more

You need to pipe the "si" commands to a collect command to send to any index. Alternatively, you can make a scheduled search and check the box to enable summary indexing and choose the index. E.g. ....|sitimechart count by site |collect index="site_summary" Ofcourse, site_summary has to be an existing index. ... View more

Running 4.3.1 search head... ... View more

I am also getting this error. Originally, I was getting it on 3 of my search heads, but now only 2. No amount of restarting or reinstalling seems to help. Does anyone know how to wipe the Java Bridge clean? ... View more

I found the non-default instance name part: http://splunk-base.splunk.com/answers/66459/connect-to-a-non-default-instance-of-ms-sql-server. The remaining question is whether Integrated security can be used for MS SQL. ... View more