Hi folks, i hope somebody can help me. I have a network script running to pull in the routing config from my routers and having a terrible time extracting the fields i need. I have some regex that works in regex101 but not in splunk for some reason when using 'rex field=_raw' at search time. Code so far is below but not perfect: ^(?<Code>[\w\*\%\+]+)\s+(?<route>(\d{1,3}\.){3}\d{1,3}(\/\d+){0,1})\s.+?,\s+(?<Interface>[\w\-\.]+) I have fudged the ip addresses in the data sample below for obvious reasons and would greatly appreciate some help. Extractions required are: 1 - Extract Codes (example L - local, ia - IS-IS inter area, * - candidate default) into a field called 'routing_codes'. 2 - Extract individual routing code letters (examples S*, C, L etc...) into a field called 'route_code'. 3 - Extract top level routing entry (examples 10.0.0.0/8, 99.0.0.0/32, 172.107.0.0/32) into field called 'iprange' 4 - Extract individual routes (example 192.168.79.123, 172.111.242.196, 172.107.79.123) into feild called 'route' 5 - Extract outgoing interfaces (example Vlan1, Vlan200, Loopback13) into field called 'interface' Data Sample: ___________________________________________________________________________ 10/09/2018 17:15:25 : Started route_scraper Execute Command Script on Devices 4 devices selected Devices: 4 Errors: 0 ___________________________________________________________________________ router-r-s-71193-01 (10.2.199.98): show ip route Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + - replicated route, % - next hop override Gateway of last resort is 89.189.89.191 to network 0.0.0.0 S* 0.0.0.0/0 [1/0] via 89.189.88.190 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.71.193.0/24 is directly connected, Vlan1 L 10.71.193.1/32 is directly connected, Vlan1 99.00.00.00/32 is subnetted, 1 subnets C 99.99.99.199 is directly connected, Virtual-Access1.1 172.168.0.0/32 is subnetted, 1 subnets C 172.168.80.31 is directly connected, Loopback10 172.168.0.0/32 is subnetted, 1 subnets C 172.168.242.253 is directly connected, Loopback13 192.168.80.0/32 is subnetted, 1 subnets C 192.168.80.31 is directly connected, Loopback1 ___________________________________________________________________________ router-r-s-72241-01 (10.2.199.99): show ip route Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + - replicated route, % - next hop override Gateway of last resort is 88.188.88.188 to network 0.0.0.0 S* 0.0.0.0/0 [1/0] via 88.189.89.189 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.72.241.0/24 is directly connected, Vlan1 L 10.72.241.1/32 is directly connected, Vlan1 99.0.0.0/32 is subnetted, 1 subnets C 99.99.199.198 is directly connected, Virtual-Access1.1 172.17.0.0/16 is variably subnetted, 2 subnets, 2 masks C 172.17.1.80/28 is directly connected, Vlan200 L 172.17.1.81/32 is directly connected, Vlan200 172.107.0.0/32 is subnetted, 1 subnets C 172.107.79.123 is directly connected, Loopback10 172.111.0.0/32 is subnetted, 1 subnets C 172.111.242.196 is directly connected, Loopback13 192.168.79.0/32 is subnetted, 1 subnets C 192.168.79.123 is directly connected, Loopback1 ___________________________________________________________________________ thanks ... View more

Having mixed results with this issue? I have trap messages being written to a txt file which then gets pushed to my indexer via a universal forwarder and I also have line breaks setup in props.conf. The trap message then appears in full as a multi-line event. This is the line break config for the trap message: [imsva_log] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = ^\d{2}\/\d{2}\/2\d{3}\s\d{1,2}:\d{2}\s(A|P)M BREAK_ONLY_BEFORE_DATE = false Unsure if the above config is best for trap messages but it seems to work. Pic of traps as they come into splunk: imgur.com/RcmA93R) I then use the IFX tool to extract specific lines from the trap message, however this sometimes works and sometimes breaks? When it works it successfully extracts the results of 1 line. Pic of a working extraction: imgur.com/E0xtHs3 Other times it extracts the line i want but it also extracts the rest of the message so i end up with multiple lines in my extraction. Pic of a non working extraction: imgur.com/EKdUOFm I have played about with the rex config in props.conf to stop extracting after the end of line but having no joy with this. What rex can i use that basically says 'stop' after the end of line and do not continue with any more extraction. This is the rex config generated from IFX: EXTRACT-imsva_log_type = (?i) .*?: (?P<imsva_log_type>[a-z]+) EXTRACT-imsva_trapoid = (?im)^(?:[^:\n]*:){2}\w+\.\d+\.\d+\s+(?P<imsva_trapoid>.+) Cheers for any help. *apologies for the pics but dont have enough karma points to post inside the question - yeah great eh and i am paying big bucks for splunk support? ... View more

I am having no success in disabling the web service on my universal forwarders? Issue: Security team were able to browse to my universal forwarders using https://[universalforwarder]:8089. I have been instructed to kill the web service on the UFs. Have tried: creating a new web.conf placed in etc/system/local with the following settings applied startwebserver = 0 httpport = 0 With these settings in place and removal of the old web.conf file sitting in etc/default i am still able to web onto my UF's from a remote machine? Am i missing a setting somewhere? thanks ... View more

Hi All I am trying to create an alert that triggers whenever i receive a high risk notification from my IPS. I have my splunk search term below that returns the correct trap message, but i need to know how i can filter further by the victims network address. The victims IP is contained in the following line: cidsAlertVictimAddress:= osIdSource="unknown" osRelevance="relevant" osType="unknown" 10.37.99.223:161 I would like to trigger my alert whenever this trap message comes in from any 10.37.0.0 source. I had a bash at regex but couldnt get past: | rex field=cidsAlertVictimAddress My Splunk query is this: index=myindex source=ips sourcetype=ips_threat What do i need to append my query with in order to only alert on the victimaddress sitting on network 10.37.0.0 The trap message looks like this: 11/22/2013 4:13 PM 123.123.123.123:123.123.123.123 CISCO-CIDS-MIB:ciscoCidsAlert SNMP Trap Received Time:11/22/2013 4:13:58 PM Source:456.456.456.456(456.456.456.456) Community:public Variable Bindings sysUpTime:= 112 days 19 hours 59 minutes 37.05 seconds (974877705) snmpTrapOID:= CISCO-CIDS-MIB:ciscoCidsAlert (1.3.6.1.4.1.9.9.383.0.1) cidsGeneralEventId:= 1323036804139549916 cidsGeneralLocalTime:= 11/22/2013 4:13:58 PM (B90LFhANOgA=) cidsGeneralUTCTime:= 11/22/2013 4:13:58 PM (B90LFhANOgA=) cidsGeneralOriginatorHostId:= ZBTDCSRMP002 cidsAlertSeverity:= high cidsAlertAlarmTraits:= 2147483648 cidsAlertSignature:= Community Invalid Length cidsAlertSignatureSigName:= SNMP Protocol Violation cidsAlertSignatureSigId:= 4507 cidsAlertSignatureSubSigId:= 6 cidsAlertSignatureVersion:= S17 cidsAlertInterfaceGroup:= 0 cidsAlertVlan:= 0 cidsAlertAttackerAddress:= 192.168.188.20:50556 cidsAlertVictimAddress:= osIdSource="unknown" osRelevance="relevant" osType="unknown" 10.37.99.223:161 cidsAlertDetails:= InterfaceAttributes: context="single_vf" physical="Unknown" backplane="GigabitEthernet0/1" ; cidsAlertEventRiskRating:= 100 cidsAlert.26:= 3 cidsAlert.27:= 17 cidsAlert.42:= 65 cidsAlert.46:= 1 any help appreciated ta ... View more

Tried a number of variations here but to no avail. Situation: I have a number of UFs sending data onto a LWF which then sends all data onto my indexer. On my indexer i have created an index to store the data. I am trying to route all the data into this new index from the LWF and have had little luck so far. On the LWF i placed the following global stanza in inputs.conf: [default] index=mynewindex From what i have read, this should direct all data coming in from all the UF's into mynewindex sitting on the indexer. This does not work? I swapped out the LWF with a HF and still the same result? Am i missing something from my conf files? This did work if i added the above stanza to the inputs.conf file located on the UF's but this is not the way i want to do it. I just want one entry to manage on my LWF/HF that can achieve the same result. I appreciate any guidance. ... View more