Found a solution here - https://www.outcoldsolutions.com/blog/2021-06-24-splunk-internal-logs/ ... View more

Just what I was looking for 🙂 ... View more

I had the same problem with the maxmind build int asn_lookup_by_cidr. Turns out the lookup file is too large. I copied the lookup file with a subset of data and created a new lookup definition unsine match_type=CIDR | inputlookup asn_lookup_by_cidr | head 100000 | rename ip AS sub | outputlookup asn_lookup_by_cidr_fix.csv When I reached the 400K mark the lookup stopped working. Raising the max_memtable_bytes value in limits.conf should fix it. ... View more

This should be marked as the new solution. ... View more

I'm looking at this too. As of ES 6.4.1 this is still seemingly the case. Adding this immediately after the datamodel command in the correlation search extracts the weight field: | rex field=_raw "weight=\"?(?<wt>[^\s,\"]+)" | eval weight=coalesce(weight,wt)   ... View more

Hi I know this is quite old thread. However, Now I'm suing Add-on for Amazon Web Services version 5.0.0. I have ingested ELB logs as described in https://docs.splunk.com/Documentation/AddOns/released/AWS/IncrementalS3. Now I could see the logs are being ingested. However, those events still no parsing. still I could see only the raw logs. I have added the props.conf as you shows above, still the issue is same.  Am I missing something else?  ... View more

We fixed the whole thing ourselves. Switched around some fields, removed some cruft and mapped netconn eventtypes that have a domain to the Network Resolution datamodel. Next up: process execution mapping to the Change Analysis datamodel (file_name, file_hash, etc.) ... View more