Hi. We are going to have a datasource with some sensitive data, where there is a requirement, that only the owner of a specific event is allowed to see it. The events will have the user as part of the data, that field can be created as an indexed field. I will, of course, have the data in a separate index, and thought I might be able to use restriction to limit access so that the user only can search in data where the field user matches the logged on user. I can see it is possible to use the token $env.user$ in a dashboard, but I would really like to use it in the restrictions part of the role, so it automatically will use the logged on user in the restriction.   Any help will be much appreciated. Kind regards las   ... View more

Hi. We have some IBM DB2 systems running primarily on AIX and now our Security team has tasked us with collecting the audit log in Splunk. I tried just creating an input, monitor-stanza pointing it to the right directory, but nothing, I then changed to look at subfolders, and I got some data. I have looked at the DB2 documentation, and there is a very cumbersome process described (https://www.ibm.com/docs/en/db2/11.1?topic=facility-storage-analysis-audit-logs). Does anybody have some experience collecting DB2 audit logs and how did you do it (file monitor or DB-Connect)?   Kind regards las ... View more

Hi. I would like to know if anybode else had this issue. We upgraded our UF on AIX to 8.1.3 from 8.0.4, following the guidelines from Splunk. We have set outputs.conf to use indexer discovery. After the upgrade we saw these message: ERROR IndexerDiscoveryHeartbeatThread - Error in Indexer Discovery communication. Verify that the pass4SymmKey set under [indexer_discovery:prod] in 'outputs.conf' matches the same setting under [indexer_discovery] in 'server.conf' on the Cluster Master. [uri=https://xxxx:8089/services/indexer_discovery http_code=502 http_response="OK"] The pass4SymmKey has not changed during the upgrade. We changed the configuration to bypass indexer discovery, and that got data flowing into the system again.   Kind regards Lars Søndergaard ... View more

Hi. I have a business requirement where I need to index data from multiple of our vendors that also use Splunk. The vendors have added a _TCP_ROUTING to send data to both our Heavy Forwarders and their own infrastructure.   I have a dedicated port for each vendor in my inputs.conf on the Heavy Forwarder: [splunktcp-ssl:9997] disabled = 0 _meta userindex::splunk_test My idea was to have a different userindex for each input stanza Next step is a generic props.conf: [host::*] TRANSFORMS-force_index = force_index   Finally I was hoping it would be possible to do the magic in my transforms.conf: [force_index] DEST_KEY = MetaData:Sourcetype REGEX = (.+) FORMAT = $1 SOURCE_KEY = _meta:userindex WRITE_META = true I know I'm not rewriting the index, but it is easier to look at the sourcetype, as the events get indexed and it should be a small change to rewrite the index instead of the sourcetype. Long story... so to the question. Is it possible to reference the _meta variable I have set in the input stanza in the regex of the transform on the same Heavy Forwarder?   Kind regards Lars   P.S. I agree it is a bad idea to rewrite the index, it should be set at the source, but I think it is necessary, as our indexes do not match those of our vendors and I want each vendors data to be indexed in the same index. ... View more

Hi. We are about to ingest logs from multiple suppliers, where the individual supplier has full control over their infrastructure. My take was to to create a couple of heavy forwarders and dedicate a port to each supplier: supplier_1 sends data to port 9991 supplier_2 sends data to port 9992 ... This part I think I have working. The next problem is that I have a need to separate the data from supplier_1 from supplier_2, My thought was to create a index per supplier. The problem is then how do I route data received from port 9991 to index_1 regardless of what is configured on the Universal Forwarder, except for Splunk stuff (_internal ...) the different suppliers might use the same source or sourcetype, so it is only the receiving port on the heavy forwarder I might use to separate the data. Any help is much appreciated Kind regards ... View more

Hi. It seems Microsoft has exposed the audit log for Azure DevOps, https://docs.microsoft.com/en-us/rest/api/azure/devops/audit/audit%20log/query?view=azure-devops-rest-5.1 Has anyone tried to index this log and how did you do it? Kind regards las ... View more