Really nobody who came across this issue?  ... View more

Nobody came across this issue?  ... View more

So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt    ... View more

Thanks for your answer. I'm not sure if this is what I want. Because the advanced hunting app requires an API call with a limit of calls, I start doing a call on DeviceProcessEvents. Then I'm not sure if I need to do another API call on DeviceRegistryEvents, since I'd like to joint these two instances.  ... View more

Thank you for your answer. So in order to pull the logs from all these Windows devices through WMI, one needs only a Universal Forwarder on one Windows device and send it to the Splunk cloud right? ... View more

Anyone? WIth advice? ... View more

I've now this search: index=* source="stream:*" source="stream:fortistream" |table timestamp, src_ip, dest_ip, ,dest_port, sum(bytes_in), sum(bytes_out) But how do I make sure the values of scr_ip and dest_ip belong together within the same data flow? ... View more

Basically this will work for me: index=* source="stream:*" source="stream:fortistream" |table timestamp, src_ip, dest_ip, ,dest_port, sum(bytes_in), sum(bytes_out) So what do I need this crazy search that comes with the stream app datamodel for then? Why did they set it up like this? ... View more

Thanks! When I convert the syntax like this: index=* source=stream:Splunk_IP | rex field=src_ip "(?<src1>.*)\.(?<src2>.*)\.(?<src3>.*)\.(?<src4>.*)" | where src1 NOT null | rex field=dest_ip "(?<dest1>.*)\.(?<dest2>.*)\.(?<dest3>.*)\.(?<dest4>.*)" | where dest1 NOT null | | eval source_ip = src1 + "." + src2 +"." + src3 + "." + src4 | eval destination_ip = dest1 + "." + dest2 + "." + dest3 + "." + dest4 | eventstats sum(sum(bytes)) as bytes by source_ip, destination_ip | stats latest(source_ip), latest(destination_ip), sum(count) by bytes | rename latest(source_ip) as "Source IP", latest(destination_ip) as "Destination IP", sum(count) as "Flows", bytes as "Bytes", sourcetype as "Sourcetype" It produces an error message: Error in 'SearchParser': Missing a search command before '|'. Error at position '235' of search query 'search index=* source=stream:Splunk_IP | rex field...{snipped} {errorcontext = OT null | | eval sour}'. You'd say you don't need the source_ip, however it's part of the data model. If I try search on src_ip I don't get any data.. Or.. I'm doing wrong search, what would be the search syntax then? ... View more

Thanks, I wonder why they even use the round function on an ipaddress!? 🙂 Anyway, if I remove it I mess up the syntax completely.. ... View more

This mystery is still not solved.. Yes, I get data now with this query index= source="stream:fortistream" in verbose mode: But still ip addresses are only showing the first two octets.. Hmm, I suspect the regex: rex field=src_ip "(?<src1>.*)\.(?<src2>.*)\.(?<src3>.*)\.(?<src4>.*)" basically the field ip is calculated as: (?:(?<!\d)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?!\d)) So where is the syntax error...???? Anyone? ... View more

So next I've created a new stream "fortistream" protocol netflow. Then I've edited the search from the VF dashboard like this: index= source="stream:fortistream" | rex field=src_ip "(?.).(?.).(?.).(?.)" | where src1 NOT null | rex field=dest_ip "(?.).(?.).(?.).(?.)" | where dest1 NOT null | eval source_ip=round(src1+exact(src2.001), 3) | eval destination_ip=round(dest1+exact(dest2*.001), 3) | eventstats sum(sum(bytes)) as bytes by source_ip, destination_ip | stats latest(source_ip), latest(destination_ip), sum(count) by bytes | rename latest(source_ip) as "Source IP", latest(destination_ip) as "Destination IP", sum(count) as "Flows", bytes as "Bytes", sourcetype as "Sourcetype" Put it in verbose mode. Now I do get data but ONLY the flow data. And here is the funny thing: The source ip address is cut in half.. (192.168) The destination ip address too (8.008) Very weird.. ... View more

So next I've created a new stream "fortistream" protocol netflow. Then I've edited the search from the VF dashboard like this: index=* source="stream:fortistream" | rex field=src_ip "(?.).(?.).(?.).(?.)" | where src1 NOT null | rex field=dest_ip "(?.).(?.).(?.).(?.)" | where dest1 NOT null | eval source_ip=round(src1+exact(src2*.001), 3) | eval destination_ip=round(dest1+exact(dest2*.001), 3) | eventstats sum(sum(bytes)) as bytes by source_ip, destination_ip | stats latest(source_ip), latest(destination_ip), sum(count) by bytes | rename latest(source_ip) as "Source IP", latest(destination_ip) as "Destination IP", sum(count) as "Flows", bytes as "Bytes", sourcetype as "Sourcetype" Put it in verbose mode. Now I do get data but ONLY the flow data. And here is the funny thing: The source ip address is cut in half.. (192.168) The destination ip address too (8.008) Very weird.. ... View more

This query doesn't return data either (Extracted from flow visualisation) index=* source=stream:Splunk_IP ... View more

This query doesn't return data (This is extracted from the SPL): index=* source="stream:Splunk_Tcp" ... View more

I do get data running this query btw: index=* source="stream:*" splunk_server="host_ip" ... View more

Yes, this topic is answered. ... View more

When I run the search like that "index=* source=stream:Splunk_IP" I don't get any results.. ... View more