Hello, I'm running Splunk 6 with Enterprise Security 2.4. I've populated the "assets" lookups table (assets.csv) to include several IP's along with their names and priorities. For example: ip nt_host priority 10.10.10.10 SERVER1 high I have dashboards that of course include IP addresses, etc. My question is, how do I add the asset name to my dashboard (search) to include the nt_host name? What is confusing me is that "nt_host" isn't an available field in search results related to 10.10.10.10. Otherwise it would be easy, I would just add "nt_host" as a field in my underlying search in the dashboard panel. As always, thanks for your help! ... View more

Hello, This is a correlation search included with Enterprise Security that detects and alerts for potential spyware activity: | `src_dest_tracker("allowed")` | lookup local=true ip_spyware_lookup src OUTPUTNEW src_ip as src_spyware_ip,src_description,src_is_spyware | lookup local=true ip_spyware_lookup dest OUTPUTNEW dest_ip as dest_spyware_ip,dest_description,dest_is_spyware | search dest_is_spyware=true OR src_is_spyware=true | eval spyware_ip=if(dest_is_spyware=="true",dest_spyware_ip,spyware_ip) | eval spyware_ip=if(src_is_spyware=="true",src_spyware_ip,spyware_ip) | eval spyware_description=if(dest_is_spyware=="true",dest_description,spyware_description) | eval spyware_description=if(src_is_spyware=="true",src_description,spyware_description) | fields + sourcetype,src,dest,spyware_ip,spyware_description My question is, is there a way to tweak this search so that it only alerts when there are more than X number of events? In other words, let me know when an IP address triggers this rule 5 times (within a 24 hour period). I thought it was as simple as adding: "| search count>5" to the end of the search string but it didn't work. Thanks for any tips! ... View more

Hello, I use Splunk's iplocation (not Maxmind or other) command extensively in our monitoring dashboards. Since this is Splunk's "built-in" geoip command, does the underlying geoip database get automatically updated or do I have to manually update it? If manual, how do I update it? Thanks! ++ Edit: I also checked the iplocation documentation but it doesn't describe how to update the geoip database: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Iplocation +++ Edit 4/4/14: I re-installed Maxmind per a recent suggestion that Splunk's iplocation command uses Maxmind's geoip database. After re-installing Maxmind and restarting Splunk, I ran two identical searches with geoip lookups: one with Splunk's iplocation and the other with Maxmind's geoip command. The results were different, proving that Splunk's iplocation command does not use Maxmind's geoip database. This also explains why the iplocation command will continue to work even if you uninstall the Maxmind app (and delete all of the directories as well). Also, I found that the iplocation command produces much better results (more complete) than Maxmind's "lookup geoip.." command (doesn't have geoip info for many IPs in our logs, which is why I prefer to use Splunk's iplocation command). So this question is still open... ++++ Edit 4/14/14: I searched the /splunk for *geo* (not sure why I didn't do this earlier!) and found this file: /splunk/share/ipv4.geodb Does anyone know if this is Splunk's geoip database for the iplocation command? And if so, same question stands... how does it get updated? Thanks! ... View more

Hello, Has anyone implemented whois lookups in Splunk - and if so, how did you do it? I tried the whois add-on @ http://apps.splunk.com/app/321/ but didn't have any luck with it. Thanks! Update 5/16: (bump) ... View more

Hello, One of my sourcetypes is bcoat_proxysg (BlueCoat). Within the Search app, I have all of the correct/expected fields. Within the Enterprise Security app, there is a different set of fields and none of the relevant BlueCoat fields (like http_referrer and http_user_agent) are available. It's almost as if the sourcetype is broken within ES (but it's fine in Search). None of my other sourcetypes have this problem so I'm really confused about why the fields are different between the two apps. Update: I tried the suggested answer below last night and made the changes to TA-bluecoat but this didn't make any difference. So currently in my Search app, the sourcetype=bcoat_proxysg fields are correct but in my ES app the fields are incorrect. I'm looking for guidance on where I should begin to troubleshoot this... I'm really confused why this is happening in the first place... I thought that a sourcetype (once defined) would have the same fields available in all apps. Do I need to do field extractions twice... once for Search and once for ES??? Thanks! ... View more

Hello, I have Splunk 6 and Enterprise Security 3 (latest version). I'm also indexing data from our Symantec endpoints. There is an app: "Splunk for Symantec" but also technology add-ons: "TA-sep" and "TA-sav" (depending on Symantec version). Considering that I'm running Enterprise Security, which apps and add-ons do I really need? This is my understanding: I'm assuming that I don't need the full "Splunk for Symantec" app since I have Enterprise Security and ES has the endpoint/malware dashboards that I need. I'm assuming that I need the TA-sep and TA-sav apps to index the Symantec data properly. I'm a little confused between the Symantec App and the Symantec TA's and how they are different and how they affect (or don't affect) Enterprise Security so I'm just looking for some clarity. For example, if I disable the Splunk for Symantec app does that mean I will stop indexing Symantec data? And if so, then what are the TA's for? Ditto for BlueCoat... there is an app but also a technology add-on. Thanks! ... View more

I upgraded to the latest version of Enterprise Security (v6.0) and it installed many new apps and add-ons for systems/applications/sources that we don't have including: Splunk Add-on for AirDefense Splunk Add-on for CEF Splunk Add-on for Juniper Splunk Add-on for RSA and many more... My question is, can I disable the apps/add-ons that I don't need or will this adversely affect ES? Also, after disabling the app, how can I fully delete it so that it no longer appears in the apps list (I like to run lean and prefer not to have unused software installed). Thanks! ... View more

Hello, How can I get a trend of total events by sourcetype in a graph over a week? My indexing volume dropped significantly and I'm having trouble identifying which one of my sourcetypes is indexing less data today vs 1 week ago. Thanks! ... View more

Hello, I'm running Splunk 6 and Enterprise Security 3. I'm having several problems when attempting to edit the default ES navigation menu (configure > general > navigation): I cannot add a "new collection" which is a new menu item. I can name it but then the new name doesn't get saved. I also cannot drag any items (unused reports) into it. I cannot rename any collections (the changes do not get saved). Moving a collection/menu item or anything around in the editor is very difficult, if not impossible. The item or collection you are trying to move, moves around the screen erratically and very quickly, too quick to have any control of where you are moving an item to. I've tried IE and Firefox and have the same problems in both. Although, problem #3 is somewhat alleviated in IE. So my question is, is there a .conf file (or another file) that I can edit to modify the navigation menu manually since I'm having trouble making the edits in the UI's navigation editor? Thanks! ... View more

Hello, I know how to use the iplocation command to obtain geo ip information for a single field, for example: sourcetype="IPS" | iplocation src_ip | table src_ip, City, Country Is there a way to return geo ip information for 2 fields (in this case src-ip and dest-ip)? I tried this but it doesn't work: sourcetype="IPS" | iplocation src_ip, dest_ip | table src_ip, City, Country, dest_ip, City, Country How would I return geo ip info for both src-ip and dest-ip in a single search? Thanks! ... View more