Hola @Sergio1 , antes de nada te recomiendo que escribas las preguntas en inglés para que llegue al máximo posible de oyentes y obtengas una respuesta más rápida. Con respecto a tu pregunta, lo primero que deberías hacer es comprobar con el visor de eventos (Event Viewer) en Windows que los eventos 4663 se están generando. En caso de que así sea hay varias cosas que puedes hacer con respecto a Splunk: 1) ¿Te llegan algún otro tipo de eventos Windows desde esa misma máquina? Si es así es posible que tu inputs.conf no esté bien configurado o que estés usando blacklist/whitelist incorrectamente. 2) Si no te llegan eventos Windows de ningún tipo, revisa bien la configuración local de tu Splunk Forwarder. Lo más sencillo si tienes acceso a esa máquina es que ejecutes btool sobre inputs.conf ($SPLUNK_HOME/bin/splunk btool inputs list --debug) para ver qué tienes configurado y las preferencias. Allí debería de haber alguna entrada tipo WinEventLog://Security donde o bien estás leyendo todos los eventos de Security o bien tienes un whitelist/blacklist especificando cuales lees. 3) Comprueba también que llegan eventos a los índices internos desde esa máquina. Simplemente usa index=_* host=YOURHOST, donde YOURHOST es la máquina que tiene que enviar los 4663. Así de paso compruebas conectividad con tus Indexers o Heavy Forwarders. 4) Otra cosa más, suponiendo que tu configuración de inputs.conf sea la correcta, ¿has especificado el index donde se van insertar estos eventos? Si no es así irá al que tengas por defecto, normalmente main. Y si has especificado otro, ¿te has asegurado de que el índice existe y tienes permisos para leer? Yo empezaría por estos pasos, pero la solución dependerá mucho de lo que te vayas encontrando. Un saludo ----- TRANSLATED TO ENGLISH WITH CHATGPT (sorry I'm too lazy to bother and the outcome is actually very good):   Hello @Sergio1, first of all, I recommend that you write the questions in English so that it reaches as many listeners as possible and you get a faster response. Regarding your question, the first thing you should do is check with the Event Viewer on Windows that the 4663 events are being generated. If that's the case, there are several things you can do regarding Splunk: 1) Are you receiving any other types of Windows events from the same machine? If so, it's possible that your inputs.conf is not properly configured or you're using blacklist/whitelist incorrectly. 2) If you're not receiving any Windows events of any kind, thoroughly review the local configuration of your Splunk Forwarder. The easiest way, if you have access to that machine, is to run btool on inputs.conf ($SPLUNK_HOME/bin/splunk btool inputs list --debug) to see what you have configured and the preferences. There should be an entry like WinEventLog://Security where you're either reading all Security events or you have a whitelist/blacklist specifying which events you're reading. 3) Also, check if events from that machine are reaching the internal indexes. Simply use index=_* host=YOURHOST, where YOURHOST is the machine that should be sending the 4663 events. This way, you also test connectivity with your Indexers or Heavy Forwarders. 4) Another thing, assuming your inputs.conf configuration is correct, have you specified the index where these events should be inserted? If not, they will go to the default one, usually main. And if you have specified another index, have you ensured that the index exists and you have permissions to read from it? I would start with these steps, but the solution will depend a lot on what you find along the way. Best regards.   Javier ... View more

Hi @MG , you can use eventstats instead of stats for that as in | eventstats count by idx.   Hope that helps. ... View more

Hi, use search instead of where and problem solved. Or you could also do | where isNotNull(ppp) ... View more

Hi @pamkkkkk , you could also try the following: | rex max_match=0 "(?msi)(?<raw>FreeSpace.+?IsSystemdrive\s+:\s+\w+)\s*" | fields - _raw | mvexpand raw | rex field=raw mode=sed "s/ //g" | rex field=raw mode=sed "s/\n/ /g" | rename raw as _raw | extract pairdelim=" " kvdelim=":"   This is how I tested it and the output:   If you write your PS output already in key=value pairs (or key:value, or any other delimiter) it'll be easier to extract than multiline and a lot cheaper from a performance point of view.   Regards, J   ... View more

Hi, I have uploaded your data to my lab and then extracted what I think are the host and client fields (correct me if I'm wrong please). Then I did the transaction as per the below: index=foo source=example | rex "\[(?<host>[^\]]+).+client (?<client>\w+)" | transaction client, host maxevents=2 maxpause=2 startswith="cli" endswith=eval(match(_raw, "(says|TLS)")) | table client, host, _raw And this is what I see as output, which looks OK to me based on the client and host: If I remove the endswith from transaction this is what I get instead: Which is very similar but not exactly the same. This is because you are forcing it to start with cli and then your maxevents are 2, meaning it's going to pick the next client/host combination matching the starting one. Whereas with the endswith you are forcing it to match says or TLS. In any case, your event containing "says" won't match any other event in the list as the host (assumning I did the extraction correctly) is plotter@connect.hku.hk. Let me know if that helps. ... View more

Hi @suspense ,   I'm not sure I fully understand your request. If you want to show EDR:Security events where cvs > 7 and all EDR:Assets then you can do the following:   index=security ( (sourcetype=EDR:Security cvs>7) OR sourcetype=EDR:Assets ) ... View more

Hi @stwong ,   So far the only typos I've noticed in your regex are the missing parenthesis: ... | transaction client endswith=eval(match(_raw, "(string1|string2|string3)"))   If that's still not matching please post details about your raw data and the actual regex you are using. Regards, J   ... View more

Hi @VK18 , please let us know if any of the previous answers helped so that we can close the thread.   Regards, Javier ... View more

Hi @PeterGian please let us know if any of the answers provided helped and therefore we can close the topic, or you need more assistance. Thanks, J ... View more

Hi @VK18 ,   You can rename a Correlation Search label (but not the actual saved search stanza within savedsearches.conf) from Settings > Searches, reports and alerts > Find your search there > Then click on advanced edit > look for the field "action.correlationsearch.label". Edit that value and the actual label you see when going to the Correlation Searches page will be updated. If you want to edit both the search name and its correlation search label you have to do it through the savedsearches.conf file but sometimes is easier to just clone it with a different name from the GUI (including permissions) and then simply delete the old one. Let me know if that helps. Regards, J     ... View more

Hi @PeterGian, Let's say your column names are FieldA and FieldB, in that case your spl could look like the following:   index=foo sourcetype=bar earliest=-1d@d | bucket span=1d _time | eval Yesterday = if(relative_time(now(), "@d") > _time, FieldB, null()), ```this is yesterday``` Today = if(relative_time(now(), "@d") <= _time, FieldB, null()) ```this is today``` | stats values(Yesterday) as Yesterday, values(Today) as Today by FieldA | fillnull value=NULL     Note I have not tested the SPL syntax. Hope it helps, if not please post more details about your question. Regards, J   ... View more

You have to configure the email notification settings:   https://docs.splunk.com/Documentation/Splunk/9.0.0/Alert/Emailnotification ... View more

Hi, Perhaps you can do it with timechart and a where clause. Something like: <base-search> earliest="-7d@d" latest="@d" | timechart span=1d count as sum by ip where sum > 1 ... View more

Run the search, then click on "Save As" > Alert and chose your schedule and within "Trigger Actions" select "Send email".    ... View more

Sure no problem. Don't forget to mark the above as answered so that we can close the thread. Regards, Javier ... View more

Hi, the first line is wrong, try using one of the following two: index=mbda_windows_server sourcetype=XmlWinEventLog EventCode IN (4718, 4728, 4729, 4730, 4732, 4733, 4756, 4757, 4762, 4796, 5136) index=mbda_windows_server sourcetype=XmlWinEventLog (EventCode=4718 OR EventCode=4728 OR EventCode=4729 OR EventCode=4730 OR EventCode=4732 OR EventCode=4733 OR EventCode=4756 OR EventCode=4757 OR EventCode=4762 OR EventCode=4796 OR EventCode=5136) ... View more

It probably can but would it not be cleaner to use a lookup table instead? So instead of | where jobStreamName IN( "stream1" ,"stream2" ,"stream3" ... ,"stream277" )   You would do: | lookup jobStreamLookup jobStreamName as jobStreamName OUTPUT jobStreamName AS match | where isNotNull(match)   Your lookup file would be as simple as:   jobStreamName ----------------------- stream1 stream2 stream3 ...   Be careful with the case sensitivity though.   Regards, Javier ... View more

It will look like the following: index=YOURINDEXHERE | regex Commandline="(regex1|regex2.*regex3)"   But I could be wrong as I still don't know what sort of regex you want to write or what kind of string you want to match. Hope it helps anyway.   ... View more

Hi again, I couldn’t say. There are many ways to do it. If you can be a bit more specific about your regex I might be able to help more.  Translating Boolean operators to regex is not trivial and it is not what regex was designed for originally.  You can replicate an OR the way I told you earlier. You can replicate an AND by simply doing a second regex after the first one but also within the same regular expression assuming the text you want to match follows that order.  In summary, if you can give us an example of what you are trying to match we could probably help you a lot more.  ... View more