@mbarbaro, you can lower the amount of days that your Accelerated Data Models are setup for to decrease the amount of disk space you are using per Data Model. This is all dependent on the amount of events vs the amount of time for Data model on how much space the _summary will take up. http://docs.splunk.com/Documentation/Splunk/6.6.2/Knowledge/Acceleratedatamodels ... View more

@Mystica856 the few times I did run into the above issue was due to a bad API or Secret Key. Hopefuly when you generated your key you copied it down from Nessus. If you do have to pull new keys make sure that you copy them down in a safe place and try adding them back to both Host and Plugin on the HF configuration page. ... View more

@ADPSTT using this search index=windows sourcetype=Script:InstalledApps host=* | search DisplayName="VMware Tools" | table host would get you all servers with "VMWare Tools" the string would match exactly that installed. One thing to verify is that the DisplayName is exactly "VMWare Tools" if its not then you can use Wild Cards "VMWare Tools*" or something like that to match multiple different names for the tools ex "VMWare Tools version 6.4". If you were to use the following search you would also get those results dropping the first pipe, since you can remove more events/servers right off the bat and not have to store those for the next pipe index=windows sourcetype=Script:InstalledApps DisplayName="VMware Tools*" | table host if you have multiple entrys for the same server then you can do a dedup before the host your search | dedup host | table host ... View more

To accomplish this for viewing of only those Dashboards/Panels within ES you would have to modify all of the panels/views within ES and remove Read (all) rights. Then you would create a New Role that did not inherit rights from any user and grant the needed index'es/rights for the Role. Then you would select all Roles for viewing minus your new role for the panels/dashboards you did not want view access on, then for the ones that the new User/Role would get View access to you would select that Role also or reselect (all). Again this method will take some time and will take some testing to verify all still works after the change. ... View more

@pfabrizi the default setting for [splunkd_remote_searches] is 10000. You can increase this number via props.conf like the below stanza. In this example you would set the Truncate to 99999. [splunkd_remote_searches] TRUNCATE = 99999 ... View more

@pil321 did you set the host_segment inside of your inputs.conf? I would think it would default to the actual UF device if one isn't designated, but it could be possible it doesn't. ... View more

@daniel333 take a look at the following document https://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Anonymizedata There may be a few ways you can address in a props.conf if you are able to regex out where your KV pairs are coming from you can use that solution. If not then the other option will be doing a complete replace of ' to " in that file source. ... View more

Great update to the code @willi358. I do not have an environment with nessus data to test this out anymore but I'm sure this update will make the plugin_output field data that much more useful now. ... View more

Thank you for reaching out @willi358. I have moved on from the position where I wrote this code for and would need to get an environment setup to test further. You can do a field alias for plugin_output{} changing it too plugin_output for your sourcetype=nessus:scan http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addaliasestofields and for the line breaking issue can you supply me with an event so I can test further, for possible formatting within Splunk? ... View more

Go ahead and add a eval to replace the forward slash before the lookup. yoursearch | eval url=replace (url,"/"," ") | lookup yoursearch ... View more

Go ahead and change your where to search index=Windows sourcetype=WinEventLog:Security EventCode=4625 earliest=-25h@h latest=-1h@h | eval Account_Name=mvindex(Account_Name, 1) | search Source_Network_Address!="-" | stats count(EventCode) as Authentication_Failures values(Source_Network_Address) as Source_Network_Address by Account_Name | search Authentication_Failures > 10 | sort -Authentication_Failures ... View more

I was using a csv with the generated data so you can sum Authentication_Failures if your totaling the actual times failed login also index=Windows sourcetype=WinEventLog:Security EventCode=4625 | eval Account_Name=mvindex(Account_Name, 1) | stats sum(EventCode) as Authentication_Failures list(Source_Network_Address) as Source_Network_Address by Account_Name ... View more

@MikeElliott try something like this index=Windows sourcetype=WinEventLog:Security EventCode=4625 | eval Account_Name=mvindex(Account_Name, 1) | stats list(EventCode) as Authentication_Failures list(Source_Network_Address) as Source_Network_Address by Account_Name ... View more

I think I see what the problem is; you have two searches that need to take place to match on ID from Plugin and plugin_ID from the scans. Give this search a try, it may take a bit longer. I'm going to use some of @cmerriman 's written code hope you don't mind. index=nessus cve=* | eval ID=coalesce(id,plugin_id) | eval CVSS_SCORE = cvss_base_score + cvss_temporal_score | rename cve as CVE | stats sum(CVSS_SCORE) as CVSS_SCORE values(plugin_name) as Plugin_Name by ID | appendcols [search index=nessus | rename host-ip as hostip | stats list(hostip) as hostips, list(IP) as IP, count(hostip) as HOSTS by plugin_id] | table ID, Plugin_Name, CVSS_SCORE, HOSTS | sort - CVSS_SCORE ... View more

Give this a try made a change to by ID since it seems to be id then you rename to ID index=nessus cve=* | eval CVSS_SCORE = cvss_base_score + cvss_temporal_score | stats list(host-ip) as host-ip, list(IP) as IP count(host-ip) by id | rename id as ID, cve as CVE, plugin_name as Plugin_Name, count(host-ip) as HOSTS | table ID, Plugin_Name, CVSS_SCORE, HOSTS | sort - CVSS_SCORE ... View more

Ok go ahead and take out the usessl field from both default/ldap.conf and local/ldap.conf and try the following for ldap_filter ldap_filter = "(objectclass=*)" ... View more

@kpavan any luck? ... View more

With the reverse of Test, Stage, Train, and Production Production = 4 Train = 3 Stage = 2 Test = 1 Sorry missed the order was more of a -- this should work for you just have to change the parameters. ... View more

Ok, also to verify your appname/default/ldap.conf looks like this and also go ahead and remove scope on your appname/local/ldap.conf # Author: MuS # # passwords in here are base64, you will not use clear text passwords! # [bund] server = x500.bund.de port = 389 binddn = basedn = cn=Liegenschaften,o=Bund,c=DE password = 0 ldap_filter = (objectclass=*) usessl = 0 [default] server = ldap.forumsys.com port = 389 usessl = 0 binddn = cn=read-only-admin,dc=example,dc=com basedn = dc=example,dc=com password = cGFzc3dvcmQ= ldap_filter = (objectclass=*) I'm working on trying to recreate the issue on my side with no success. ... View more

Hello @kpavan any luck? ... View more

Ok taking a look at the code from the python script it is looking for the following. try: # lets do it if myDebug == "yes": logger.info( "read the default options from ldap.conf..." ) # logger if myDebug == "yes": logger.info( "reading server from ldap.conf..." ) # logger server = parser.get(section_name, 'server') # always check username and password in ldap.conf, never provided by user! if myDebug == "yes": logger.info( "reading user/pwd from ldap.conf..." ) # logger password = parser.get(section_name, 'password') binddn = parser.get(section_name, 'binddn') # check for user provided basedn options or use [default] stanza if myDebug == "yes": logger.info( "reading basedn from ldap.conf..." ) # logger if basedn == "basedn": basedn = parser.get(section_name, 'basedn') else: basedn = basedn # check for user provided ldap_filter options or use [default] stanza if myDebug == "yes": logger.info( "reading ldap_filter from ldap.conf..." ) # logger if ldap_filter == "0": ldap_filter = parser.get(section_name, 'ldap_filter') else: ldap_filter = ldap_filter # check for user provided scope options or use [default] stanza if myDebug == "yes": logger.info( "reading base from ldap.conf..." ) # logger if scope == "base": scope = ldap.SCOPE_BASE elif scope == "one": scope = ldap.SCOPE_ONELEVEL else: scope = ldap.SCOPE_SUBTREE # check for user provided port options or use [default] stanza if myDebug == "yes": logger.info( "reading port from ldap.conf..." ) # logger if port == "389": port = parser.get(section_name, 'port') else: port = port # check [default] stanza if we need ssl if myDebug == "yes": logger.info( "reading usessl from ldap.conf..." ) # logger usessl = parser.get(section_name, 'usessl') if usessl == "1": conn_string = "ldaps://%s:%s" % ( server, port ) else: conn_string = "ldap://%s:%s" % ( server, port ) It looks like maybe the scope input is missing. Try adding a scope field. [STGLDAP] server = xx.xx.xx.xx port = xxxx usessl = 0 scope = yourscope binddn = ou=stgldap,dc=stg,dc=org basedn = dc=stg,dc=org password = UGFzc3dvcmQxMjM= ldap_filter = (ou=SelfRegUser) ... View more