index=_audit sourcetype=audittrail action IN ("login attempt" logout) | table _time host user info reason clientip method session​     If you add a filter on the user field you can narrow down to specific account. - clientip: source IP of connection, obviously NAT could hide the source but that's up to your network layout - session: this is the http auth token that other users have already shown how to force delete from the system ... View more

Our splunk environment is all running on FreeBSD, and has for years, so this was kind of a shock when I went to look into updating. This puts a large impact on our infrastructure and IT staff, knowing that we have to now migrate our Splunk environment off onto a new platform. ... View more

Agreed. I think the term itself caused a bit of alert. "Phone Home" is the term used with Command and Control traffic where the pwned bot calls back for the hackers instructions. Maybe it would be better to use the term "Deployment server poll" or similar. Thanks, Ferdie ... View more

Well, nevermind. I changed my firewall to allow all traffic, and now it works. I have the Forwarder communicating and configured on my "instance." Whew, that only took 4 hours. 🙂 ... View more

I enabled introspection on one of my UF's to see what it would provide. Where in DMC is this new information displayed? I already had information for forwarders under the "Forwarders" section. Trying to determine what added benefits if any to enable this on UF's. Thanks ... View more

Thanks for the info. We've moved some capabilities of the Deployment Monitor App into the platform, namely the License Usage/Report. See this. I would also suggest looking at the S.o.S "Indexing and Forwarding" views that allow split-by Forwarders. For now unfortunately, a lot of the Forwarder-centric views/alerts that were in Deployment Monitor don't have an equivalent as we wind down support for Deployment Monitor but we are working on it actively. The Forwarder Management view (viewed in Settings on your Deployment Server, if you use Deployment Server) will give you some insight, a bit differently albeit than the "Missing Forwarder" alert in Deployment Monitor, about which Forwarders were talking to your Deployment Server instance but have ceased phoning home. See this. Definitely acknowledge this is a less active approach than an email alert. ... View more

Try this: http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime In inputs.conf [monitor:///your-path/filename] sourcetype=header-file In props.conf [header-file] FIELD_DELIMITER=space HEADER_FIELD_DELIMITER=space HEADER_FIELD_LINE_NUMBER=20 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false Should dump the first 19 lines (the garbage) and use the header found in line 20. If the header is variable length, you can use other methods such as FIELD_HEADER_REGEX. Note this will work on Forwarders and does the header/field mapping at index-time. ... View more

INDEXED_EXTRACTIONS is attempting to use the first line as the header (the column/field names). That is why you are only seeing 3 events. You can use DELIMS here but in Splunk 6 we introduced: INDEXED_EXTRACTIONS = csv specifically so you don't have to define the fields in DELIMS. We attempt to automatically read the first line of the CSV (usually the header) and create index-time fields. So, if the file has no header, you can use INDEXED_EXTRACTIONS = csv with the FIELD_NAMES option: http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime OR use props/transforms with DELIMS but you cannot mix the two. ... View more

If you are using Splunk 6 on both Forwarder and Indexer (or just ingesting logs locally on the indexer) set sourcetype=iis in your inputs.conf. Under the covers, this is using INDEXED_EXTRACTIONS=W3C in props.conf and will automatically pick up the header and use it for field mappings so you don't have to mess with props and transforms. http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime ... View more

Windows 8 and Windows Server 2012 are now officially supported Splunk platforms. ... View more

Splunk will support you on Splunk issues if you're running on Veritas Cluster Server, but can't support you on Veritas issues as that's really your responsibility. That said, here is one way in which you can set up Splunk under Veritas. Put each Splunk instance into a Veritas service consisting of and depending on: Dedicated storage for that instance A virtual external IP and DNS name for that instance The corresponding Splunk executable and configuration files for that instance, stored on the instance storage The running application and associated monitoring/control of the application state Each instance is normally expected to run on a single physical cluster node. But to allow any instance to run on any node, you should also set configuration to ensure no conflicts by using different values for the following for each instance: File paths of the Splunk installation home File paths of the Splunk data indexes Network port numbers for Splunkd API, SplunkWeb, Splunk TCP input, Splunk TCP-SSL input, and any other network inputs Forwarders should forward to the Virtual cluster address of each instance, using the corresponding input port numbers for each instance. Search heads should query against the Virtual cluster addresses of each instance using the corresponding Splunkd port number numbers for each instance. ... View more

We've deprecated CHECK_FOR_HEADER in Splunk 6 and replaced it with more robust header controls. See: http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime ... View more

Use Header-based Index-time field extractions: http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime In your example above, you could use HEADER_FIELD_LINE_NUMBER=4 or if there is garbage before the field names in the header FIELD_HEADER_REGEX=HEADER\s(.*) ... View more

Well, I just noticed that if you click the link on a phone, the nav loads all collapsed and thus the page is quite different. The "reference docs" I was referring to are indeed on this page though - If you click the link on PC or a mac look under "Props.conf attributes for structured data". As far as I know there are no examples of INDEXED_EXTRACTIONS anywhere on the splunk site (which is sad and strange). I meant to post only the link to the cell in the reference table. ... View more

Support was added for Solaris 11 in Splunk 5.0. ... View more

I see that you use ShibUseHeaders On while others use RequestHeader set REMOTE-USER %{REMOTE_USER}s . The big difference is that ShibUseHeaders returns many headers which can be used elsewhere (like ou , or group or memberOf ), while the latter only returns the REMOTE_USER header. But Note that the Shibboleth Documentation gives the following warning about ShibUseHeaders : ''Use of this option should be avoided. Be sure to review the topic on spoof checking if you enable it.'' ... View more

Given the change of state, I unaccepted my prior answer (that was years old) and marked ogdin's as correct. ... View more

Yes. I should have qualified that. This specific field in the AD logs use NT epoch. Thanks. ... View more

In Splunk 6, you can also use INDEXED_EXTRACTIONS=W3C which auto-extracts the fields from the headers at index-time. http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime ... View more