Try this one: | rex field=_raw "(?<=POST|GET)\s(<?yourfield>\/[^\/]*)" ... View more

Hey I believe that your best solution is to use eventgen. The reason the field cluster doesn't show in the mock index is that collect gets only the _raw data into the new index (and allows you to change host and source and sourcetype which are metada fields), and cluster is a search time created field. Collect is not intended for generating "sample" data. Check eventgen https://splunkbase.splunk.com/app/1924/ ... View more

Why do you say it is not CIM? I took a look at the tags and eventtypes and they will surely be matched agains CIM. Am I missing something here? ... View more

Well as the docs say, Maintenance mode halts most bucket fixup activity and prevents frequent rolling of hot buckets. https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Usemaintenancemode What will happen when you put that peer offline is that all the hot buckets will be rolled to warm as a result of the splunk stop command. If you do this very often, you may end up having very small buckets in your environment, which is not great as Splunk would need to check several buckets for the data someone has searched instead of few. ... View more

Can you please paste a full example of the GET request? ... View more

Splunk doesn't constantly lock a file so you don't have to worry about that. Just put a monitor stanza over the file. (Imagine how splunk would be useless monitoring log files if it blocked it from being written at all times) ... View more

Hey If you change the configuration files directly, splunk does not know you have changed something. .conf files are never re-read before you actually restart Splunk, and that is actually the expected behaviour. As @cusello has mentioned, if you are using a deployment server to pull changes to the Universal Forwarders, then you should make sure that: after changing some configuration in an app under deployment_apps, you must splunk repload deploy-server in order to make the DS aware you changed things are recreate a checksum of what you have in the app the serverclass should have the option "restart splunk" enabled so your Universal Forwarders restart automatically and your changes turn into runtime configurations. https://docs.splunk.com/Documentation/MSApp/1.4.3/MSInfra/Setupadeploymentserver ... View more

How about | chart count(events) as "Events" over date_month by Name, Type ... View more

Well although it is not your own ingested data, the impact is you can't debug actions and assure accountability of what users have been doing That is quite a security issue you have in case you need to justify or figure out internal sequence of events You are unconsciously covering tracks ... View more

Are you ingesting that file somehow or just inputing it as a lookup? ... View more

I think what you can do is to try to do that on your DC side. Splunk just maps Groups to Roles and that's ti. If you can figure out your strategy on the DC side, then it is fine. But in Splunk I don't think so ... View more

Hey You can mapp LDAP groups ( as well as SAML) to Splunk Roles: https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/MapLDAPgroupstoSplunkroles ... View more

Hey You have a qualys.conf file that you can easily deploy massively: [setupentity] username = password = api_server = https://qualysapi.qualys.com log_detections = 1 log_host_summary = 1 log_extra_host_summary = 1 log_host_details_in_detections = 1 minimum_qid = 0 first_run = True use_proxy = False proxy_user = proxy_server = proxy_password = use_multi_threading = False num_threads = 2 enable_debug = False preserve_api_output = False last_run_datetime = log_individual_findings = 1 log_webapp_summary = 1 use_multi_threading_for_was = False num_threads_for_was = 2 ... View more

I created a sourcetype named lastline in SPLUNK_HOME/etc/apps/search/local/props.conf [lastline] SEDCMD-alter=s/Lastline//g Restarted Splunk Created a dummy file: Tiago Lastline TiagoTiagog Lastline asdkas dasds asd a12 e122wqd 12e ` 2 Lastline Last wdqas asdasd Lastline And the result was the expected Tiago TiagoTiagog asdkas dasds asd a12 e122wqd 12e ` 2 Last wdqas asdasd If you have restarted splunk after creating the sourcetype in props and your events have the sourcetype "lastline" and still you don't have the expected results: Do this $SPLUNK_HOME/bin/splunk btool props list -- debug Find your sourcetype and check if your SEDCMD is there in the Stanza ... View more

Is the whole splunk folder owned by a user that you are impersonating and you have exec permissions on that? ... View more

Hey Are you executing that from the $SPLUNK_HOME/bin directory? ... View more

Yes I believe it is exactly what you need: command line utility that submits event data to Splunk from stdin.command line utility that submits event data to Splunk from stdin. ... View more

Yes, I missed a * in the first \s: | rex field=_raw "ACTION\s*\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])" ... View more

Hey There is a oneshot.py in the Python sdk, have you had a look at it? Also how about retrieving that data to a file a have Splunk monitor it after your script gets it? Let me know your thoughts ... View more

I don't see that possible if you don't have an element to trace the events back. Can you show us a piece of your log with the events you mentioned? ... View more

You can do that but you are forgetting the return in the return search [ |inputlookup lookup1 | return 10 index,source] [| inputlookup planned_downtime_ee | eval latest=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , earliest=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S") | eval maintenance="NOT (_time>"+earliest+" AND _time<"+latest+")" | return 10 $maintenance | rex mode=sed field=search "s/OR/AND/g" | return $search] So for any pair of index, source in the lookup1, you are excluding all the maintenance times. This logically only works if the maintenance times are the same for all pairs (index,source). If not, then you need to have a correspondence between maintenance perior and (index,source) pairs ... View more