Hey Are you looking for the Administrative lookup of ES? /en-US/app/SplunkEnterpriseSecuritySuite/ess_lookups_edit?namespace=SA-IdentityManagement&transform=administrative_identity_lookup Or is it the case that all your logins are being wrongfully tagged with tag="default"? Look at the DataSet definition **Default Authentication** (`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) Constraint tag="default" ... View more

Hey I just tried your example curl and this one doesn't work but curl -k -u admin:pass https://localhost:8094/services/data/threat_intel/item/ip_intel -d item='{"ip":58.64.179.144}' -G -X GET But the second one, with the ip between double quotes work. curl -k -u admin:pass https://localhost:8094/services/data/threat_intel/item/ip_intel -d item='{"ip":"58.64.179.144"}' -G -X GET Can you try it please? ... View more

Sorry, I think I finally understood what you intend: search *login* earliest=-365d | eval unique_date= date_mday +"/" + date_month | stats count by unique_date, user | stats count by user | eval remaining_days = 110-count Let me know if that is what you want to send to the users ... View more

Hey what connects your events? Anything to pick up for that? ... View more

Ok so then just change the earliest time you are looking at it: search *login* earliest=-30d | eval unique_date= date_mday +"/" + date_month | stats count by unique_date, user | stats count by user | eval crossed_threshold=if(count>110,"True","False") ... View more

Sorry I'm not following now. Do you want to store the results of this search in a lookup? Or do you have a lookup with something else that you want to include in the search? ... View more

This may be because your changes in the input are not being detected by Splunk. The code is missing some parts, any chance you could get them in the question? ... View more

Hey search *login* earliest=-365d | eval unique_date= date_mday +"/" + date_month | stats count by unique_date, user | stats count by user | eval crossed_threshold=if(count>110,"True","False") If the result of that search is greater than 110 for any user in a 365 days period, then he crossed your threshold. Could this sketch be according to your needs? ... View more

Well the answer is yes. Adding to the security layer that having indexes enforces by using roles and their allowed to search list of indexes, splunk searches also gain from having separate indexes. The main reason is if you are searching an index that has a high number of sourcetypes and your search spreads through a specific time range, then Splunk would have to gzip more slices of data to check whether the data your are asking for is there or not. If you are searching one index only, then even if you are searching in more than one bucket, at least you know that you are being more precise. More, you can specify retention policies per index, not per sourcetype, so it eases up your life having them separated. ... View more

Agreed, not a good idea indeed. But if for some reason the user is into using the CM as a Listener, I believe this would be the way ... View more

Are you forwarding the data from the Cluster Master to the Indexers? In the cluster master 1 - Create an outputs.conf pointing to the indexer: https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configureforwardingwithoutputs.conf 2 - Create an app in the $SPLUNK_HOME/etc/master-apps and put an inputs.conf there with the stanza: [splunktcp:<port_you_are_sending_from_the_Cluster_master>] Then in the Cluster Master $SPLUNK_HOME/bin/splunk validate cluster-bundle $SPLUNK_HOME/bin/splunk apply cluster-bundle And with this you will be forwarding all the data arriving to the Cluster Master to the indexer layer like you want ... View more

Yes it is possible, check this command: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Outlier ... View more

Have you checked the maxevents Syntax: maxevents=<int> Description: The maximum number of events in a transaction. If the value is negative this constraint is disabled. Default: 1000 That with value 2 will get you the immediate next event with abc value. ... View more

Try the delta command: | makeresults | eval A=10 | append [| makeresults | eval A=20 ] | delta A Don't forget to upvote useful comments ... View more

Here is the test I made for your use case. I just didn't use the sourcetype as SOURCE_KEY. Instead, I;m using _raw for simplicity in the mock up construction: inputs.conf [monitor::///home/tiago/Desktop/test.txt] index=xyz sourcetype=xyz props.conf [xyz] TRANSFORMS-xyz = override_xyz DATETIME_CONFIG = NO_BINARY_CHECK = true SHOULD_LINEMERGE = false disabled = false pulldown_type = true transforms.conf [override_xyz] REGEX=^(?!xyz).+ SOURCE_KEY = _raw DEST_KEY= MetaData:Sourcetype FORMAT= sourcetype::overriden_sourcetype Here is my testfile: aqwdqwd asdq aaaxyz xyz And here are the results 3/19/18 1:01:17.000 PM xyz host = tiagoubuntu source = /home/tiago/Desktop/test.txt sourcetype = xyz 3/19/18 1:01:10.000 PM aaaxyz host = tiagoubuntu source = /home/tiago/Desktop/test.txt sourcetype = overriden_sourcetype 3/19/18 1:01:02.000 PM asdq host = tiagoubuntu source = /home/tiago/Desktop/test.txt sourcetype = overriden_sourcetype 3/19/18 1:00:51.000 PM aqwdqwd host = tiagoubuntu source = /home/tiago/Desktop/test.txt sourcetype = overriden_sourcetype So my diagnose is your problem is not the regex itself, but probably the value you are having in your sourcetype at first. Can you make a similar test to this one and give me feedback? ... View more

Sorry, I meant date_month and not date_mday, so you could use: earliest=-2mon@mon latest=@mon index=linux (host=abc OR host=xyz) COMMAND=LMN | chart dc(PID) AS Value1 over host by date_month ... View more

Hi This case works similar to the standalone one. You just need to create an inputs.conf to monitor the log files you are generating with the syslog. The proper sourcetype is also in the Splunk Sonicwall all, in the props.conf, so your configuration in the HF should be something like Inputs.conf in $SPLUNK_HOME/etc/apps/sonicwall/local/Inputs.conf [monitor:《yourlogsdir》] Index=yourindex sourcetype=the one in props.conf You also need to create the index in all the indexers. And finally you need to configure outputs.conf to send the data to the indexers. Note also that If the Sonicwall sourcetype you use has search time extractions then you need to put it in the search heads ... View more

Can you show what search is the base for the alert? ... View more

Use brook to figure out what retention period you are having on this one. It's too precise so there must be a default retention period for the internal indexes somewhere in you environment. $SPLUNK_HOME/bin/btool indexes list --debug and check for the internal. ... View more

Yes sure why not? Please upvote the comments that were useful after you accepted the answer ... View more

Could you have your license_usage.log checked for data longer than that? Do you have the most recent data? Could someone have deleted older data than those 7 days of usage? Do you always have those 7days and no more than that at all times? ... View more

Well then you have to solve that first just to have your internal logs (including dbx ) being sent and properly searched in the indexers layer. ... View more