Oh yeah sorry, the by date part is messing that up. I think you can move the split 'by date' to the end. I'm on my phone right now but will check this for you later. ... View more

Your last command is a stats command so you get that view. Updated: <...> | timechart count, first(BaseLine) as Baseline by date | eval BaseLine=1240 ... View more

There is no official date that can be communicated yet for supporting the Splunk App for Microsoft Windows Active Directory. It is being worked on currently by our solutions team and we will share the date when it is available. ... View more

Update: The Splunk App for Enterprise Security 3.0 that is compatible with Splunk 6 is now available. http://apps.splunk.com/app/263/ ... View more

Sounds like port 514 is already in use on the windows server. Can you validate ports in use by which processes via netstat -b -a. ... View more

The colon is ok, no? ... View more

There are trade offs of course. More events means more to process and license. Packing the data in as you have above means less data but a lot more time spent on configuring your fields etc...to get the data in properly. ... View more

Using key-value pairs would be ideal. http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 ... View more

There is a documentation tab on the App website. If you run into issues after following those steps feel free to post a question. http://apps.splunk.com/app/1293 ... View more

I would double check the steps in the docs to make sure you haven't missed anything. I see this quite often on the Splunk App for AD. However, this is a pretty good troubleshooting reference to help as well. http://blogs.splunk.com/2012/10/21/splunk-app-for-active-directory-and-the-top-10-issues/ ... View more

Sounds like you need to post a new question with your specific challenge. ... View more

Hard to understand what's happening given the details. However, here is the app that you were referring to: http://apps.splunk.com/app/494 ... View more

First thing I would check is to make sure you only have the Cisco Security Suite and Splunk for Cisco Firewalls installed. If you have tried other apps like the TA for Cisco ASA, Cisco ASA and FWSM Field Extractions etc., I would suggest deleting them from the apps directory. They can cause issues with field extractions and searches. 1) Sourcetype should be automatically forced to “cisco_asa”, if not see step 3 for possible resolution. a. To verify just run the below search, and verify that cisco_asa is correctly set as the sourcetype: i. %ASA | dedup sourcetype | table sourcetype b. Sometimes you might have to change the sourcetype for the UDP data to “syslog” for the Cisco Security App to recognize it. 2) Go through the setup page per App and save them. Restart Splunk. 3) If the additional sourcetype (cisco_asa) is not being created then the force transform REGEX is not working correctly. Here are the steps to fix this: a. Edit the transforms.conf file in the Splunk_CiscoFirewalls App. ($SPLUNK_HOME/etc/apps/Splunk_CiscoFirewalls/default/transforms.conf) [force_sourcetype_for_cisco_asa] DEST_KEY = MetaData:Sourcetype ##REGEX = %ASA-\d+-\d+ REGEX = %ASA--\d+-\d+ FORMAT = sourcetype::cisco_asa The default REGEX is incorrect (ie has -- instead of -). Just comment out the incorrect REGEX and uncomment the correct REGEX: [force_sourcetype_for_cisco_asa] DEST_KEY = MetaData:Sourcetype REGEX = %ASA-\d+-\d+ #REGEX = %ASA--\d+-\d+ FORMAT = sourcetype::cisco_asa ... View more

There is now the Splunk for Nagios app available on apps.splunk.com. http://apps.splunk.com/app/352 This would give a great start with getting nagios data into Splunk and then using the availability reports that are in the app. ... View more

Splunk is flexible enough to ingest any log format. You just need to make sure Splunk can get access to the logs via our forwarder or have that information sent via UDP or TCP would also work. ... View more

The easiest way to preserve your syslog would be to send the data to a syslog server first (like rsyslog, syslog-ng) and then have a Splunk forwarder monitor those files. However, you can forward data from Splunk to another host. http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Forwarddatatothird-partysystemsd You could use our SDKs to pull the data out of Splunk as well. dev.splunk.com ... View more

Sounds like the WinEvents data is coming directly to your Splunk server. Check for the inputs there. http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/MonitorWindowsdata#Use_inputs.conf_to_configure_event_log_monitoring ... View more

You can use '| rename oldfield as newfield' to rename a field. The above search should give you MB as the first column and then count and percentage. You can hide percentage (showperc=false). By definition the top command will give you the top 5 in descending order and then "OTHER". You can use sort -count but i'm assuming this would put OTHER as the highest value. ... View more

enter code herePerhaps you could try using the top command with the useother option. <search> | stats sum(ValueA) as MB | top 5 useother=true MB http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Top ... View more

The first thing I'd recommend is doing a pipe to table and break this thing down to make sure you're getting the numbers you think you are getting. what is this part for - '| search all'? I'm guessing if you do the follow below you may not have any data. index=os host= sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all | table pctIdle, application_name ... View more

No, we need the excel converted to CSV. http://answers.splunk.com/answers/48887/excel-spreadsheet-as-input-to-splunk-not-csv-file ... View more

yes, it's not ideal but this is something you only need to configure once and it's the only work around currently. Please check back once you see updates to the Checkpoint app to see if it gets added to the next version. You'll see it mentioned in release notes or the readme. ... View more

This is not something we can do in the app today. I have verified that there is an open enhancement for your request and our solutions team is looking at adding it in a future update of the app. ... View more

You are correct. Updating now. Looks like references were changed in the online docs. ... View more