Wondering if anyone is able to provide some information / feedback around a requirement I have. We due to various reasons are not using SPLUNK forwarders to send data to SPLUNK. We use an agent called SNARE that sends logs that then collects in an Index. In previous trials we found that there were TA's available for things like Powershell, Sysmon that SPLUNK would index appropriately and we could search on those indexes explicitly. The SNARE agent we are using doesn't do that and writes to 1 agent. Would it be possible to change the way our agent logs to SPLUNK by changing the format type to "SYSLOG" from "SNARE" to the same index's used and utilise the SPLUNK TA's (and associated indexers) to capture the information? ... View more

I am trying to perform a search and trying to add an inputlookup to filter information I don't need to know about. For example if I run the following query index=firewall NOT [|inputlookup agent-inclusion-knownapps | where NOT cidrmatch("x.x.x.x/x",dest_ip) AND NOT cidrmatch("y.y.y.y/y",dest_ip) | fields agent] | stats count by agent | sort -count This produces a result and the logs filter correctly (proved by removing NOT and only seeing the entries from the inputlookup; and adding the NOT and not seeing the entries from the inputlookup). However if I then try to extend my query with the following it no longer filters and I am not sure where I have gone wrong. The query is as follows: index=firewall "destination network"=external NOT(action=blocked) NOT [|inputlookup agent-inclusion-knownapps | where NOT cidrmatch("x.x.x.x/x",dest_ip) AND NOT cidrmatch("y.y.y.y/y",dest_ip) | fields agent] | stats count by agent username src dest dest_port rule action | sort -count ... View more

I have an index called "adusers". This index pulls in all information about enabled user accounts. For the purposes of this post the values I am interested in is the "SamAccountName" so that I am able to then table information about "Surname, GivenName". So when I see my index I can see SamAccountName = USER123 Surname = Bloggs GivenName = Joe If I do a search on my index I get the data index=adusers name=user123 | table name, Surname, GivenName I also have a inputlookup file that I would like to reference. The inputlookup file is a csv (lookup is called vip) that looks as follows: username user123 user456 userabc user987 If I do the following search I get data |inputlookup vip What I am trying to do is to search on my index using the inputlookup but I am not getting any results (time is set to "All time"). So if I do the following search index=adusers [|inputlookup vip] ==> no results index=adusers [|inputlookup vip | rename SamAccountName as username] ==> no results index=adusers [|inputlookup vip | rename username as SameAccountName] ==> no results index=adusers [|inputlookup vip | rename SamAccountName as username | fields username] ==> no results index=adusers [|inputlookup vip | rename username as SamAccountName | fields SamAccountName] ==> no results I have this query working on a different dashboard but as the fields are the same in both the index and lookup I don't have this problem. I am trying to rename a field (either on the index or the lookup) so that I am able to search the information. What I am trying to generate is: If a user exists in the inputlookup file (vip), look in the index (adusers) for that user and then from that index(adusers) get data (whatever) to generate a dashboard from it. Where am I going wrong? ... View more

Hopefully a straight forward question, can the SPLUNK universal forwarder (or the SPLUNK heavy forwarder) send to different SIEMS? For example if I configured the SPLUNK UF to send to (1) a SPLUNK indexer and (2) a 3rd-party SIEM would this work? I understand that the configuration can only have 1 active link at a time. I can't "load balance" these as the SPLUNK indexer and the 3rd-party SIEM might take a different log format. Same question applies to the Heavy Forwarder. ... View more

I have 2 searches that I am trying to derive information on. The first is an inputlookup that is derived from a powershell script that gets information from AD. The second is a sourcetype that is information pulled from a database (in this instance a client that is either installed or not). The purpose of my query is to identify machines that ARE in the inputlookup and if it is NOT in the sourcetype to tell me about it (in this instance I am just doing a stats to keep track of the number that meet this condition). However I am running into a problem where the NOT statement is not working. The following query was written • | inputlookup active_servers | search NOT [search sourcetype=sccm:resource | fields name] | stats dc(name) This returns values as expected. However the value is wrong. Breaking my search up into its 2 components • | inputlookup active_servers | search name=PERSVR01 This returns a result as expected. This tells me that PERSVR01 is an active server. Doing a search in my sourcetype • sourcetype=sccm:resource name=PERSVR01 returns a result showing that the server exists in that sourcetype. So therefore I have confirmed that 1) the server exists in the inputlookup 2) the server exists in the sourcetype What I need my query to tell me is "if the server is in active_servers; and is NOT in the sourcetype return a result". The original query should do this but doesn't. Any thoughts? ... View more

Hi, I am trying to write a search for figuring out whether a user has logged in within the last 90 days. At the end of the process, I want to show some visualization showing the number of users that have logged in in the last 90 days and the number of users that haven't logged in in the last 90 days. The log file is a PowerShell generated CSV file (doing a get-aduser with various selects). One of those variables is "LastLogonDate". The CSV inputs this as "19-Feb-18 2:28:46 PM" for example. I have extracted from this the date so have an extracted field called "DateLastLogon" that shows as "19-Feb-18". My calculation is meant to look at this extracted field and compare it to the current time (timenow) and do a count of the number of users where DateLastLogon is greater than 90 days and a second search where the DateLastLogon is less than 90 days. To start off with I tried this index="myindex" | eval lastlogontime=strftime(DateLastLogon,"%d-%b-%y") | eval timenow=strftime(now(),"%d-%b-%y") | eval timediff=(timenow-lastlogontime) | table timediff I also tried index="myindex" | eval lastlogontime=strftime(DateLastLogon,"%d-%m-%y") | eval timenow=strftime(now(),"%d-%m-%y") | eval timediff=(timenow-lastlogontime) | table timediff I am now stuck and require assistance as while both pieces of code will run and not error, I am getting "no results" found ... View more

I have gotten myself confused and I can't seem to find the answer I need to resolve the question I have in my head about "DB Lookup". I have DB Connect running and able to perform SQL database queries as I need them and able to pull data into an index and build searches and visualisations from the data. All of this is with an DB Input which means data coming from the database and being indexed in SPLUNK. So that I can call the data when I need to, I started looking at DB Lookup so that I can look up the data when I run a query. I also seem to get stuck at step 3 in the DB Lookup (Choose the Splunk fields to base the lookup on). I presume that this lookup is meant to go and reference other indexes that are already in SPLUNK and then map the fields into the database to the fields in the index. However what I am trying to do is build a search that does a lookup using DB Lookup but the index or fields are not yet known. So for example I have a query that looks for say non-administrative accounts on workstations. The database that holds this information is a SQL box. If I run my SQL query I get the following results (for example) user1, non-admin account, member of local administrators, on workstation ABC user2, admin account, member of local administrators, on workstation XYZ So this search is part of a governance search and so there is no pre-built query/search for it. Do I have to create an index first with the relevant information and save it as a DB Input. Then do I then save the search from the DB Input? Do I then run a query based on the DB Input saved search and do a DB lookup even though the queries are exactly the same. The problem is I could use a DB Input but the problem is there is no database time stamp in the query and the only time stamp is the import time in SPLUNK. Consequently this is pulled in in a batch and every time the query is run information is duplicated and I have to use dedup as part of my search query (the negative side to this is the index keeps growing and tailing the database I don't think works because there is no time stamp to tail to). So can I use DB Lookup with DB Connect when the query is being run as an ad-hoc query without relying on any other indexed data in SPLUNK? ... View more