Hi, I'm trying to extract a field call Priority and I have highlighted a sample of it. Upon validate, I realized there are some rows that did not hightlight "Priority: 3" and these rows has a red cross on the left (see picture below). I'm not sure what it means. Can someone please help to explain? i can't find examples from documentation on this. ... View more

Hi, I have some snort logs with prior 0,1,2,3. I used the extract new fields feature to extract the priority value as a priority field and did a pie chart by searching snort | top priority but my chart will end up show just values 0,1,2 or 3. I noticed that if I used the default fields that were non values like ip addresses, the chart actually could display by field names. Then I tried to extract another new field but selecting the string "Priority : 3" as newPriority but the field summary only shows newPriority cound as 1 x "Priority 3". How do I extract a field like the IP field where it treat 192.168.1.1 and 192.168.1.2 as 2 different value in IP field? ... View more

Hi, I have a few reports in a dashboard. How do I change the title font to Bold in the UI source code? ... View more

Hi, I managed to make the time format from Epoch to human readable but I can't really get the millisecond out. Example timeStamp":1495447178314 From Splunk it converted to "5/22/17 5:59:38.000 PM" but from https://www.epochconverter.com/, it is showing May 22, 2017 5:59:38.314 PM Reference document: http://docs.splunk.com/Documentation/Splunk/6.0/Data/Configuretimestamprecognition, .%3N should show the milliseconds. ... View more

Hi, I'm trying to study the activities of some Malware thus I created the following environment using virtualbox. But I could not get the forwarder to work correctly. I could only get 1 event when I reboot guest 2. Did I miss out some other configurations? ** Host ** Disable VirtualBox Host-Only Network so that Guest and Host could not ping each other but Guest can guest to guest. ** Guest 1: ** IE8WIN7, SP1, IE Version 8.0.7601.17514 Network: Nat Network IP: 10.0.2.15 Installed Splunk Enterprise Open port 9998 to receive events (set up at http://localhost:8000/en-US/manager/search/data/inputs/tcp/cooked) Set Firewall to allow inbound and outbound 10.0.2.4 and port 9998. ** Guest 2: ** IE8WIN7, SP1, IE Version 8.0.7601.17514 IP: 10.0.2.4 Installed Splunk Universal Forwarder Install sysmon via CLI "sysmon -i -n -accepteula" Added the following into universal forwarder input.conf "[WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = true" Set Firewall to allow inbound and outbound 10.0.2.15 and port 9998. I only got 1 event after Guest 2 reboots. After that, no matter what programs I open in Guest 2, there is no events seens from Guest 1. ... View more