Is the index created? Do you see any error related to this input or index in the _internal logs? Have you tried using a non-splunk listener (netcat) to verify the format of the data coming in? ... View more

That's a pretty broad question. Do you have the data in Splunk? What are you trying to visualize (Access by user, event codes by time, etc..). Have you looked at/installed the add-on? https://splunkbase.splunk.com/app/3434/ ... View more

I believe the issue is that when you filter out the systems that have checked in, you are left with the systems from the CSV whose "events" only have the timestamp from the file. You need to add a current _time value to your lookup events, with a bf_value of 0. This will ensure it gets added to the timechart, you can fillnull to fill in the hourly entries for these non-reporting systems with 0. Now you untable your results, so you can search for the hosts with a from_base value of 0 index=serverlist | eval from_base=1 | append [ | inputlookup servers.csv | eval _time=now() | eval from_base=0 ] | timechart span=1h sum(from_base) as from_base by host | fillnull value=0 | untable _time host from_base | where from_base=0 ... View more

I don't know how the NOT outside the parens impacts the NOT inside, also not sure what Logic you are trying to implement. This will find any events that don't have a src port of 80 or 443 or a dest of 80 443 22 5060. WHERE ( NOT All_Traffic.src_port IN (80, 443) AND NOT All_Traffic.dest_port IN (80, 443, 22, 5060) ) OR WHERE NOT ( All_Traffic.src_port IN (80, 443) OR All_Traffic.dest_port IN (80, 443, 22, 5060) ) ... View more

Slideshow will not work for users who do not have access to Splunk. If you want users who do not have a Splunk account to be able to view a dashboard, you will need to embed that dashboard on a webpage they have access. See the following on embedding reports https://docs.splunk.com/Documentation/Splunk/latest/Report/Embedscheduledreports ... View more

Great, however, what I need to know is How are you sending them? Splunk UF or Syslog? What does the outputs.conf look like? How are you receiving them? what does the inputs.conf look like ... View more

| eval "Software Affected"=case(match(vulnerability,"*Flash*"),"Adobe Flash", match(vulnerability,"*Acrobat*"),"Adobe Acrobat",match(vulnerability,"*7-Zip*"),"7-Zip",match(vulnerability,"*DES*"),"3DES","Unknown") If you have a large number so that using case isnt efficient, then using a lookup as @diogofgm recommends: | lookup yourlist vulnerability OUTPUT Software_Affected ... View more

Need to know what is being used to send the data (Splunk UF, syslog, etc..). If using Splunk, show the outputs.conf stanza's What are the settings of the input used to receive the data, show the inputs.conf stanzas ... View more

If the time value of the events in the serverlist index are correct, then try this: index=serverlist | eval from_base=1 | append [ | inputlookup testhost.csv | eval _time=now() | eval from_base=0 ] | timechart span=1h sum(from_base) as from_base by host | fillnull value=0 | untable _time host from_base | where from_base=0 ... View more

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Apparchitectureandobjectownership To make an object global the user requires the capability: admin_all_objects capability ... View more

Its not a capability, it's permissions on the app. App dropdown -> Manage Apps -> {Selected App} Permissions It lists the roles, and if the have read and/or write permissions. ... View more

you would keep evicted (incomplete transactions) and find the incomplete ones with the start event | transaction User, ComputerName startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 maxevents=2 keepevicted=true | search for closed_txn=0 AND EventCode=4624 https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Transaction ... View more

If you've reached the maximum number of concurrent search jobs. You need to either increase the limits (if you've got the infrastructure to support it) or reduce the number of searches being run as @snigdhasaxena describes ... View more

When you are searching for the event's in Splunk are you using all time or specifying a time range? If a timestamp is not getting parsed from the data correctly, its possible a future or past date is used which will prevent the events from showing up in a time constrained search. | metadata index=x type=hosts Do you see the host reporting? Check to see if the events timestamps are off: The lastTime field is the timestamp for the last time that the indexer saw an event from this host. The recentTime field is the indextime for the most recent time that the index saw an event from this host. In other words, this is the time of the last update ... View more

I don't believe Splunk audit logs will audit the changes to that level. The only way I can think of determining the details would be to compare the lookup file contents by comparing the backup versions. A log entry should show that a backup was created. You could correlate the backup file version to the change (search for "A backup of the lookup file was created"). However, I'm don't know of a way to access the backup lookup file via a Search. ... View more

index=_internal sourcetype=scheduler status="skipped" savedsearch_name="YOUR_SAVED_SEARCH" You should get events like: 08-25-2019 21:30:02.860 +0000 INFO SavedSplunker - savedsearch_id="nobody;SA-ThreatIntelligence;Threat - Correlation Searches - Lookup Gen", search_type="scheduled", user="admin", app="SA-ThreatIntelligence", savedsearch_name="Threat - Correlation Searches - Lookup Gen", priority=default, status=skipped, reason="The maximum number of concurrent running jobs for this historical scheduled search on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_cluster-wide", concurrency_limit=1, scheduled_time=1566768600, window_time=0 Which should show the reason it was skipped. ... View more

Each of the data models is created using a search string. The default for the Authentication DM is based on the macro cim_Authentication_indexes Find the macro cim_Authentication_indexes , and modify it to include or exclude specific indexes. ... View more

If you have another field containing the time, you can use chart: | chart count over your_time_field by hostname However, this does will not group the events by the hour, day, etc.. it will create a value for each unique timestamp in that field. the bin command can do that: | bin span=15m your_time_field | chart count over your_time_field by hostname As long as your time field is recognized as a time. IF not you may need to use strptime/strftime to get it to a recognized time. ... View more

So, your notable index works and your search head can send notables to it. Have you tried Creating a notable event using the search language by including | sendalert notable at the end of your search string? Make sure that the correlation search only outputs the fields you really need and that the fields don't include lots of content (like XML or excessive amounts of text). This can make it difficult for Splunk to parse the stash file. If it cannot parse the stash file, then your notable events may not be generated correctly. ... View more

it is necessary I know how much time is session active From the search you attached: | eval Duration(M)=round((Duration/60), 0) | table User,Source_Network_Address,Duration(M),ComputerName The Duration here is being is the time between the login and logoff events associated with the session. Although I believe there may be an issues: | transaction User maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 If a user RDPs to multiple system,s, those session could be incorrectly connected as a transaction since you are only using the username as the criteria. I would change that to: | transaction User, ComputerName maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 ... View more

write:errno=104 On Linux, 104 is ECONNRESET for "Connection reset by peer" – in other words, the connection was forcibly closed with a TCP RST packet, either sent out by the server or spoofed by an intermediary. ... View more