Hello,  In a Log4J scan the following directory was flagged for containing comprimised log4j.jar files. The files are contained in the below directory although the host being used is that of depricated servers in our infrastructure. I have migrated all of our splunk enterprise components to newer architecture and there exists  I am curious if there is a correct way to remove the old hosts under searchpeer including all the <old_host>.* files. If unused can I just deleted them? /opt/splunk/var/run/searchpeers/<old_host>-1641917646  (no longer exists) /opt/splunk/var/run/searchpeers/<current_host>-1641917646   (active host in use) File that is being caught by scan,  /opt/splunk/var/run/searchpeers/<old_host->41917646/apps/splunk_archiver/java-bin/jars/vendors/spark/3.0.1/lib/log4j-core-2.13.3.jar If the directories cant be safely removed i believe other documentation to say just the .jar can be removed safely. ... View more

I have added the latest version of Splunk_TA_windows to my environment using a deployment server. The app has been pushed to all windows machines, the search heads and the heavy forwarders. I have only been receiving data into the "Main" index and be unsuccessful at redirecting the data to our preferred collection points index =  wineventlog. on the deployment server i have created a  Splunk_TA_windows/local/inputs.conf file containing the following.   [WinEventLog://ForwardedEvents] index = wineventlog disabled = 0 [WinEventLog://Application] index = wineventlog disabled = 0 [WinEventLog://System] index = wineventlog disabled = 0 [XmlWinEventLog] index = wineventlog [WinEventLog] index = wineventlog   I am primarily a linux guy for splunk admin and only have 1 windows host monitored at the moment (all windows events are forwarded to and collected from this node), is there something that needs to be done differently to redirect the index for this applications? Next consideration I have is using props/transforms to change the index although am worried about the hardware impact of that on 5 million events a day. ... View more

Goal is to parse new events based on this source value into multiline events split each time a new date is encountered. Currently the events are not splitting correctly based on the date, as well as the AM/PM not being discovered causing all of the morning and afternoon data to overlap in the first 12 hours of the _time field. Time stamp from log <31-Mar-2021 3:18:04 o'clock AM MDT> <Error> <Default> [source::/fmw/product/.../servers/logs/domain-1.out] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = <\d+-\w+ TIME_PREFIX = < TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z MAX_TIMESTAMP_LOOKAHEAD = 40 [source::/fmw/product/.../servers/logs/domain-2.out] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = <\d+-\w+ TIME_PREFIX = < TIME_FORMAT = %d-%b-%Y %I:%M:%S o'clock %p %Z MAX_TIMESTAMP_LOOKAHEAD = 40 ... View more

I ran into a timeformatting issue with some of my logs due to the string starting with the following time format resulting in the indexing of months of events as a 24 hour clock (AM/PM events are both in the same 12 hour time frame. "<26-Mar-2021 12:59:56 o'clock AM MDT> <Error>......" I am trying to run a search based on a dashboard panel that is using the make results command to gather the index times that are +- 12 hours surrounding the event i am searching, i then use rex and formatting to try to correct the _time to proper AM/PM values, this appears to work up to the point before the "| search" command.  I am unable to use earliest/latest values to do a second time bounded search on the corrected time stamps. I am hoping someone can offer some advice of how to fix the time stamps to properly reflect _time values, and then search those results for a subset of events to report on. .conf files have already been updated to fix the _time when indexed moving forward, i am just stuck trying to evaluate the older data. Data/duration are example data (these are populated by drilldown options via a dashboard)     index=myindex source=mysource [ | makeresults | eval duration="00:16:35" | eval earliest=round(strptime("2021/03/24 11:23:90","%Y/%m/%d %H:%M:%S")-43200) | rex field=duration "(?<hour>\d*?):(?<min>\d*?):(?<sec>\d*)" | eval latest=earliest+(hour*3600)+(min*60)+sec+43200 | dedup earliest,latest | table earliest,latest | format ] | rex "^<(?<raw_time>.*?)>.*" | eval _time=strptime(raw_time,"%d-%b-%Y %I:%M:%S o'clock %p %Z") | search [ | makeresults | eval duration="00:16:35" | eval earliest=round(strptime("2021/03/24 11:23:90","%Y/%m/%d %H:%M:%S")) | rex field=duration "(?<hour>\d*?):(?<min>\d*?):(?<sec>\d*)" | eval latest=earliest+(hour*3600)+(min*60)+sec | dedup earliest,latest | table earliest,latest | format ]       ... View more

I am looking for help figuring out how to represent the following timestamp as a prefix for parsing time/start of events. this is contained in some logs i was provided today and am having difficulty figuring out how to get pas the "o'clock" contained within the log files. these are new logs that were indexed under an existing sourcetype that already had a working/existing timestamp format. Old format: (majority of logs) [2021-02-23T14:37:26.659-07:00] New/abnormal format: (some weird new stuff)  <23-Feb-2021 2:21:41 o'clock PM MST> I am trying to figure out how best to capture the new format logs from the existing sourcetype and redirect them into the proper timestamp configuration or a new sourcetype of their own. ... View more

I am attempting to allow for a more granular access to our indexes, i have been attempting to remove the use of the default admin,power,user roles. (which include all non-internal splunk indexes) The new idea is to have the capabilities of the default roles added into new roles or capabilities groups, with no ability to view indexes associated to them. capabilities-user capabilities-power capabilities-admin In addition various view roles have been created with no capabilities, they only include access to view indexes adding groups of indexes in a single role, or allowing for a specific user to access 1 index. view-base hire view-base security clearance view-index 5 The issue i have encountered is when assigning a new role with capabilities-user, which i have created with slighty more restricted capabilities then the normal user role, my new role (capabilities-user) is unable to edit the permissions on the saved searches it creates. I have seen some sites mention not to edit/modify the base user roles, and i wanted to know if it is safe to remove the view all non-internal indexes from the default roles. My tests showed that if i inherit the base user role to my newer modular role , ex. capabilities-user would inherit user, this allows the users of new role to once again edit the permissions of their saved searches. What is unique about the default "user" role and why are the abilities to edit your own report permissions not included in the capabilities-user i have created, is their a way to get this functionality without inheriting the default roles? ... View more

I am trying to create a search to return the source name for applications that have not been restarted in the last 30 days. A restart may be seen in the .out logs of an application by the phrase "Starting WebLogic Server with Oracle". How do I return sources that do not contain this phrase in the past 30 days? This is the simple search I am using to return the applications that do have restarts associated with them, although i can't figure out how to make it return sources with a zero count. source=*out "Starting WebLogic Server with Oracle" | stats count by source ... View more