Syslog is an option, yes ... View more

SEDCMD-source = s/, source=/, src_ip=/ Although I think a better option is to use a field alias. Settings -> Fields -> Field aliases ... View more

I would consider using the split and mvindex commands for this, assuming INDV is being extracted already: ... | eval my_field=mvindex(split(INDV,"|"),2) With regex: ... | rex field=INDV "RSPAR\|(?[^|]+)" But that really depends on the consistency of the data around your target extraction. ... View more

Have you checked the old events? Do their timestamps match their index time? In other words, are they reporting as 2 years old for LOG TIME, but they were actually indexed more recently? ... View more

I'm not sure about that default. On all my 6.5.1 systems, the default is 7776000, which is 90 days. ... View more

So weird your suggestion worked. My working install didn't need it, why does this one? Strange. Anyway, thanks for the fix. ... View more

On the working server, this is the event_renderers.conf content: /app/splunk/etc> splunk btool event_renderers list [crawled_files_stanza] css_class = eventtype = crawled_files priority = 200 template = crawledfile.html [default] css_class = eventtype = priority = 0 template = //results/EventsViewer_default_renderer.html [discovered_eventtype_stanza] css_class = eventtype = discovered_eventtype priority = 200 template = discovered.html I'll try adding the above to the non-working server. ... View more

In the event viewer. When you have a list of events returns from a search, click on the > in the "i" column. Now under event actions, select build event type. In the resulting page save your event type. You will be given a choice of colors to assign to it. Once the event type definition takes effect, your search results will be color coded. Like this: http://imgur.com/a/sTQRQ This works on a fresh install of splunk. But on my currently in-use system, it doesn't. There must be a setting somewhere to toggle it? ... View more

My problem with 6.5.1 scheduler wasn't invalid characters. It was repeated fields. Something like |stats last(FIELD1) as FIELD1 last(FIELD1) as FIELD1 . I removed the repeaters and the scheduler immediately started working. The error was found in splunkd.log. ... View more

And what about when you're setting values to capability parameters? Which one wins? Example, srchMaxTime. 2 roles. One at 300 and one at 600. Which wins? ... View more

loadjob https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Loadjob ... View more

Post processing might work, but it sounds like you'd have a lot of results from the base search. IIRC, post processing has a 10k limit. Instead, I would save your base search as a scheduled search, then use loadjob in each panel's query. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob Panel query: | loadjob savedsearch="myuserid:my_cool_app:my_saved_base_search" | timechart ... ... View more

You really need to know the field name for the IP in the second search. The single field output from the first search needs to match that. Assuming you have a field named src_ip in the second set of logs: [ search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00" | table src_ip ] sourcetype=WinEventLog* "EventCode=4624" | table src_ip, user | dedup src_ip, user This will essentially create a list of (src_ip=something OR src_ip=somethingelse ....) representing all your src_ips and insert that into your search string. ... View more

In our case it was a stats/chart command with a repeated field. | stats last(fieldA) as fieldA ... last(fieldA) as fieldA As soon as we removed the repeated fields, scheduling started firing. ... View more

Yes, his suggestions are good: Either setting up a syslog server, or sending to different ports for different devices/sourcetypes. ... View more

Nice! Good catch on the UI-based edit 🙂 ... View more

Including the remote address in the UDP input stanza is deprecated. Instead, you'll want to use transforms to change the index and/or sourcetype. In transforms.conf, something like this: [sendto_network_firewall] SOURCE_KEY = host REGEX = ^172\.16\.1\.1$ DEST_KEY = MetaData:Index FORMAT = index::network_firewall [change_asa_sourcetype] SOURCE_KEY = host REGEX = ^172\.16\.1\.1$ DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::cisco:asa In props.conf, you'd reference these stanza names in a TRANSFORM entry: [source::udp:514] TRANSFORM-asa_fixups = sendto_network_firewall, change_asa_sourcetype TRANSFORM-other_fixup = sendto_other_index, change_another_sourcetype It should be noted that changing sourcetypes is kinda messy. Many pieces of config reference sourcetype. Do they fire before or after your change? It makes things more complicated, prone to mistakes, and harder to troubleshoot. Just my 2 cents. EDIT: fixed per sjohnson's post. Good catch! ... View more

... | eval newfield=replace(Indicator_Value,"[\[\]]","") ... View more

Run over 24 hours. It will show any Fwds that haven't phoned home to the DS in the last hour. Change as required. index=_internal sourcetype=splunkd_access host="yourDS" POST /services/broker/phonehome/connection | rex field=uri "_(?<fwd_name>[^_]+)_(?<fwd_id>[-0-9A-Z]+)$" | stats latest(eval(now()-_time)) as Latest earliest(eval(now()-_time)) as Earliest by fwd_name fwd_id clientip | rename clientip as fwd_ip | where Latest>3600 Change the where clause to where Earliest<(12*3600) to show anything logging newly in the last 12 hours, for example. Warning: If your hosts have underscores in their names, the rex will not return the correct hostname, but the client ID and the IP will both still function. ... View more