Here is the scenario. I have two indexes (index=AV and index=Packet_Analysis) I use index=AV to find attack signatures and the attacker IP, then I pipe the IP results from this search into index=Packet_Analysis to see if, and when, the attacker IP did a GET from a certain domain. For example index=Packet_Analysis method=GET domain="bad.com" [search index=AV attack_sig="Bad stuff" attacker_IP=10.* |stats values(attacker_IP) as src_ip | table src_ip] |stats values(src_ip) by _time fyi - in index=AV the attacker_IP correlates to the src_ip in index=Packet_Analysis The results I need are Attacker_IP, Attack_time, Src_IP, Get_time. So,I need to display the results from the initial search with the results of the second search (with the respective times as they are different)... I believe this can be done with fields and eval, however I need an example to get started. Thank you ... View more

So I have correlated email events before where there was a UID defined as a field for all transactions of a unique email session. For example, the event containing "subject" contained a UID=xyz123 and the event containing "sender" contained a UID=xyz123, and the event containing "recipient" contained a UID=xyz123, etc... Now I am faced with transaction-events where the event containing "subject" has a UID=abc987, but the "to" and "from" events only have "abc987" and no field name... I can regex the UID value out of the "to" and "from" events, but I have not been successful stitching the events together to create the complete email session... For example, If I run this query below I can get the unique ids which will be contained in all events related to a unique email session... (by session I mean Subject, To, From, etc...) index=mail sourcetype=mail | rex field=_raw "sendmail+\S+\s(?<stitcher>[[:alnum:]]+)"|fillnull value="null"| table stitcher | WHERE stitcher!="null" here are some sample results stitcher w9FD0v3f024155 w9CCWGaF023575 w9CCAwjU026498 w9AEM7sO030350 w9ADp31g031379 w993gkLc016485 w993gjU0016459 w993UuOr000878 w9CDhH42016767 w9CDV93a026891 w9CDVAv6018597 If I search with each of theses UIDs 1 by 1, I would only get the events related to a specific email. So I tried a number of subsearches but I am having no luck...I need to feed the list back into a search and be able to list out the subject, to, and from, by UID... Looking for advice. Thank you ... View more

I have events like this.... <22>2018-10-10T09:38:50.631063-05:00 m0074417 sendmail[16942]: w9AEM7sO030350: to=<[email protected]> and I want to capture this qid > w9AEM7sO030350 I wrote a regex that worked in regex101 like this... sendmail+\S+\s(.+)\:\s and I get just the string I want... but it won't work in Splunk, when I use index=mail w9AEM7sO030350 |rex field=_raw "sendmail+\S+\s(?<stitcher>.+)\:" |stats values(stitcher) or if I use... index=mail w9AEM7sO030350 |rex field=_raw "sendmail+\S+\s(?<stitcher>.+)\:\s" |stats values(stitcher) in the events there is a space after the colon, but I cannot get it to stop capturing before the " : ". Perhaps I am doing this wrong? Please advise. Thank you ... View more

I need a capture some raw data before it is indexed and sent to a 3rd party application (via tcp_routing and transforms-routing) I would like to send it to a local dir/file... is that possible? Please advise... Thank you ... View more

I have raw data that I need to parse / break per event time stamp but I need to send it uncooked (with the event breaks) to a NiFi listener node... I don't believe this is possible.... Please confirm. Thank you ... View more

I am not finding a detailed "step by step" description for upgrading a non-clustered, non-pooled, search head. Scenario = I am removing a search head from a pool, for testing purposes. The search head is currently 6.6.3 and I want to do an in-place upgrade to 7.1. After reviewing the docs, I inferred that I need to do the following steps: 1) /opt/splunk/bin ./splunk stop 2) /opt/splunk/bin ./splunk disable boot-start 3) download 7.1 and untar > in /opt tar xvzf splunk_package_name.tgz 4) set search head mode in GUI 5) edit distributedsearch.conf (point to indexer servers) 6) set license master GUI 7) restart Am I on the right track here? Please advise. Thanks ... View more

Has anyone successfully used a Heavy Forwarder to relay Universal Forwarder(s) connectivity to a Deployment Server? The scenario is that the UFs are going to send to the HF, and the DS is needed to configure the UFs. The UFs can communicate with the HF and the HF can communicate to the DS, but the DS is behind a firewall, so it cannot communicate with the UFs. I know the HF has a FW allow, but I wanted to see if a relay would work. Please advise. Thanks ... View more

I am reading thru users, roles, and permissions documentation but not sure how to set this up. Ideally I want an account (user/pwd) that can authenticate to Splunk api and only change .confs within a certain app... Wondering if that is possible. Thank you ... View more

Has anyone used the rest API to successfully edit a conf file? I understand there are 3 methods GET, POST, DELETE. I understand one can manipulate searches but I am unfamiliar with managing objects and configurations with the API. Any advice or examples would be awesome. Thank you ... View more