I have firewall events coming to my syslog-ng server. The firewall events are in Central European Timezone, so when the events are indexed, they are showing up in this time (as expected), so about 5 hours in the future when searching. I am trying to figure out where to adjust this. I know the props.conf needs adjusted but where? I tried to add a props.conf to local within the app on the UF, but this made no change. I then tried to add props.conf within local under the firewall app on the indexer, and I stopped getting events all together??? ... View more

Not the best regex king, so I need some help please within the field "From" in my data there are emails. Within the emails there should never be a number before the @. For example, [email protected] is not valid, but [email protected] is valid. I want to find all the non valid emails. ... View more

I have the following search: | metadata type=sourcetypes| stats sum(totalCount) I want to be alerted if within a one hour period, there are 300k less events. I was using the drops by, but with the search above, there is only one event (the sum of the total count). Thoughts? ... View more

I have an IIS server and the path to the files I want to monitor looks like this: d:/web/logfiles/W3SVC1 d:/web/logfiles/W3SVC11516 d:/web/logfiles/W3SVC155546 d:/web/logfiles/W3SVC122551 Within each of the W3SV path, there are .log files correct syntax below, "/" were removed should my monitor stanza look like this? [monitor://d:\Shrine\logfiles\...\*log] OR [monitor://d:\Shrine\logfiles\*\*log] I would prefer to use the second, because the ellipse (...) can use up CPU. ... View more

This app will eventually consume all available space on the search head it is installed on. Documentation does not address this. Response from developer goes unanswered. I attempted to create a file called tsidx_retention.conf with the following [bluecoat_stats] 5 days retentionTimePeriodInSecs = 432000 I placed it at: /opt/splunk/etc/apps/SplunkforBlueCoat/local/tsidx_retention.conf But this is not working. ... View more

We have the ldapsearch app installed. I would like to query AD and get a list of all the "ACTIVE" computers that match an OU, then see if these systems are sending logs to Splunk. Thoughts??? ... View more

I have followed the steps outlined here: http://answers.splunk.com/answers/80727/issues-adding-filemaker-driver-to-db-connect but I am getting: command="dbquery", Error getting database connection: Could not create a validated object, cause: ValidateObject failed ... View more

I have a scenario where we would like to send an email to users if they are found in a search. For example, lets say we have a policy that states "you will never plug your ipod into a work computer" We have the capability to detect this type of activity, but we would like for Splunk to send an email to the user as soon as Splunk finds the activity (scheduled search). Thoughts? ... View more

I have a field called "user". I am looking for matches that contain 6 or 7 characters, and always end with "a" but does not end in "pa". I am using the following and it works, but I was wondering if someone might have a better regex expression that would be faster? regex user=".+[^p]a$" ... View more

This is my inputs.conf [fschange://C:\Users...\AppData\Local\Microsoft\Windows\Burn] index=windows recurse=true sourcetype=opticalmediaburn pollPeriod=60 followLinks=true fullEvent=true delayInMills=1000 I see this in my _internal log FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time - //C:\Users...\AppData\Local\Microsoft\Windows\Burn What am I doing wrong. The file/path does exist ... View more

I want to monitor the following C:\Users\...\AppData\Local\Microsoft\Windows\Burn sometimes with the Burn directory there will be other folders. I want to monitor all the folders and files under the burn directory The following does not appear to be working: [monitor://C:\Users\...\AppData\Local\Microsoft\Windows\burn\] sourcetype = WindowsBurnLog disabled = 0 index=windows ... View more

I have a search I use to associate a "likely" user to an IP search query | dedup src | fields src user |inputlookup src_user.csv append=true | dedup src |table src, user| outputlookup src_user.csv I am not getting accurate results and my theory is.... The results are appended to the end of the table. Splunk reads the table from top to bottom. Splunk gets the first match and then stops. The first match is old data. Does my search look correct? How can I fix this? Update... I think I identified one issue. I studied by lookup table and there are no duplicate IPs, but there are duplicate users. I want the table to represent the last know IP associated with a user. If a new IP is associated with a user, remove the old entry. Ideas???? ... View more