Unless a search is explicitly sent to the background, it is killed when the UI page that dispatched it is no longer connecting to SplunkWeb and Splunkd. Backgrounded searches continue to run, as that is the point of sending a search to the background. ... View more

The rex command doesn't check anything, it extracts fields from data. Even if you had a command that "checked", what do you want it to do? How you need Splunk to tell you, or what you you need Splunk to do on the basis of that information? Perhaps you need to look at eval http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/CommonEvalFunctions ... View more

sourcetype=mydata | stats count(eval(ClientConnectionStatus=="Connecting")) AS connecting_count count(eval(ClientConnectionStatus=="Connected")) AS connected_count by HostID | eval ratio=connected_count/connecting_count ... View more

Ah, this is the perfect use case for this (still) undocumented command, multireport : sourcetype=myhttpdata | multireport [ stats count by SourceIP ] [ stats count by SourceIP DestinationIP ] [ stats count by SourceIP DestinationIP HTTPStatus ] This gives you the data you need. Now, you need to sort the rows into the order you'd like better. This kind of works: sourcetype=myhttpdata | multireport [ stats count by SourceIP ] [ stats count by SourceIP DestinationIP ] [ stats count by SourceIP DestinationIP HTTPStatus ] | sort SourceIP DestinationIP HTTPStatus But that puts the summary rows for SourceIP and Destination IP at the end of their categories. To move them to the beginning, you need to do something hacky: sourcetype=myhttpdata | multireport [ stats count by SourceIP ] [ stats count by SourceIP DestinationIP ] [ stats count by SourceIP DestinationIP HTTPStatus ] | fillnull value="_ANY_" SourceIP DestinationIP HTTPStatus | sort SourceIP DestinationIP HTTPStatus And then if you want you can do an "eval" to convert the "_ANY" back to an empty string or null. But that gives you things in lexicographic order. What if you want them in order of most common SourceIP, then most common DestinationIP? Then you'll have to do: sourcetype=myhttpdata | multireport [ stats count as by SourceIP | eval count_sip=count ] [ stats count as by SourceIP DestinationIP | eval count_sip_dip=count ] [ stats count as by SourceIP DestinationIP HTTPStatus ] | fillnull value="_ANY_" SourceIP DestinationIP HTTPStatus | eventstats first(eval(coalesce(count_sip,null()))) as count_sip by SourceIP | eventstats first(eval(coalesce(count_sip_dip,null()))) as count_sip_dip by SourceIP DestinationIP | sort -count_sip +SourceIP -count_sip_dip +DestinationIP -count | fields - count_sip count_sip_dip Now, this gives similar results (but not the same, it lacks summary rows and instead uses different columns for the summary values): sourcetype=myhttpdata | eventstats count as count_sip by SourceIP | eventstats count as count_sip_dip by SourceIP DestinationIP | stats count first(count_sip) as count_sip first(count_sip_dip) as count_sip_dip by SourceIP DestinationIP HTTPStatus | sort -count_sip +SourceIP -count_sip_dip +DestinationIP -count but likely runs a lot slower. You could also use: sourcetype=myhttpdata | stats count by SourceIP DestinationIP HTTPStatus | eventstats sum(count) as count_sip_dip by SourceIP DestinationIP | eventstats sum(count_sip_dip) as count_sip by SourceIP | sort -count_sip +SourceIP -count_sip_dip +DestinationIP -count which will be a lot better, but for large data sets will still be slower than the version using multireport. ... View more

index="security" user="123456" EventCode=4624 OR EventCode=4634 earliest=-7d@d | bucket _time span=1d | stats earliest(_time) as First latest(_time) as Last by _time | eval First=strftimet(First,"%+") | eval Last=strftime(Last,"%+") I prefer not to use date_* fields (and instead use _time ) because those are not time-zone corrected, and they are not guaranteed to be on every event. (They will only be on events where a timestamp is extracted; ones that inherit a timestamp from a previous event or get a current timestamp won't have them.) Above is wrong. It needs to be: index="security" user="123456" EventCode=4624 OR EventCode=4634 earliest=-7d@d | bucket _time span=1d as day | stats earliest(_time) as First latest(_time) as Last by day | eval First=strftimet(First,"%H:%M:%S") | eval Last=strftime(Last,"%H:%M:%S") | eval day=strftime(day,"%Y/%m/%d") ... View more

An app will override this just fine. Settings in any "local" conf folder will override settings in any "default" folder. ... View more

You should just set up two different lookups (pointing to the same file) [squid] LOOKUP-MandiantAPTd = MandiantAPTd domain AS uri_host OUTPUTNEW LOOKUP-MandiantAPTf = MandiantAPTf filename AS uri_path OUTPUTNEW [MandiantAPTd] filename = mandiant-apt.csv case_sensitive_match=false match_type = WILDCARD(domain) [MandiantAPTf] filename = mandiant-apt.csv case_sensitive_match=false match_type = WILDCARD(filename) ... View more

Something like: sourcetype=logins_to_systems | streamstats global=f window=2 current=t earliest(_time) as previous_login_time latest(_time) as current_login_time by userid | eval time_between_logins=current_login_time - previous_login_time | stats max(time_between_logins) as longest_break by userid | where longest_break < (14*24*60*60) can give you a list of users who never had more than a 14-day break between logins. This gets you one answer, but it's not terribly generalizable to other reporting requirements and drilldowns you might have, e.g., looking for periods where activity was lower or the number of systems was lower. It would probably be useful to use: sourcetype=logins_to_systems userid="a_specific_userid" | timechart span=1d count by system_accessed as a sort of drilldown from the previous search. Now, if you want to just see which users might have logged in less, the classic: sourcetype=logins_to_systems | timechart span=1d count by user to start with might be useful, followed up with the drilldown to see what systems in particular were touched by a specific user. ... View more