mvexpand recipient worked exactly how I was expecting the results to be. Thanks all for your help! ... View more

This has been noted as a bag in ES 4.5 version. the bag has been fixed in the 4.5.1 version. Thanks jwelch for your help on that! ... View more

Thanks all. This is working exactly how I wanted it to work. ... View more

Ok I got here.... | eval severity=if(category=="INFO","informational", " ") What should my last argument be if I want the severity to stay unmodified if it does not equal INFO ? ... View more

Kiran, Apologies, I did not noticed the updated search. It was great, producing expected results ! Thanks! ... View more

the search was missing `` around drop_dm_object_name("All_Identities") Corrected and run it but it does not populate first and last name. ... View more

This also helped me solving the issue. ... View more

Understood. When used wget --no-check-certificate a file was downloaded with no issues. C:\Program Files (x86)\GnuWin32\bin>wget --no-check-certificate https://publicsu ffix.org/list/effective_tld_names.dat SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc syswgetrc = C:\Program Files (x86)\GnuWin32/etc/wgetrc --2016-10-27 14:06:13-- https://publicsuffix.org/list/effective_tld_names.dat Resolving publicsuffix.org... 63.245.213.24 Connecting to publicsuffix.org|63.245.213.24|:443... connected. WARNING: cannot verify publicsuffix.org's certificate, issued by `/C=US/O=DigiCe rt Inc/CN=DigiCert SHA2 Secure Server CA': Unable to locally verify the issuer's authority. WARNING: certificate common name `static-san.mozilla.org' doesn't match requeste d host name `publicsuffix.org'. HTTP request sent, awaiting response... 200 OK Length: 190800 (186K) [text/plain] Saving to: `effective_tld_names.dat' 100%[======================================>] 190,800 614K/s in 0.3s 2016-10-27 14:06:13 (614 KB/s) - `effective_tld_names.dat' saved [190800/190800] ... View more

There seems to be a problem with the certificate trust. It cold be something to do with TLS 1.2 Any ways to bypass the certificate verification in Splunk? C:\Program Files (x86)\GnuWin32\bin>wget https://publicsuffix.org/list/effective _tld_names.dat SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc syswgetrc = C:\Program Files (x86)\GnuWin32/etc/wgetrc --2016-10-27 13:20:47-- https://publicsuffix.org/list/effective_tld_names.dat Resolving publicsuffix.org... 63.245.213.24 Connecting to publicsuffix.org|63.245.213.24|:443... connected. ERROR: cannot verify publicsuffix.org's certificate, issued by `/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA': Unable to locally verify the issuer's authority. ERROR: certificate common name `static-san.mozilla.org' doesn't match requested host name `publicsuffix.org'. To connect to publicsuffix.org insecurely, use `--no-check-certificate'. Unable to establish SSL connection. ... View more

I am running Windows 😞 I will provide the output once I figure out an alternative to wget on Windows ... View more

mozilla_public_suffix_list is set to update every 3 hours and it keeps failing every time it tries to update. I checked the site and it is accessible - https://publicsuffix.org/list/effective_tld_names.dat What other information would you like to see to help diagnose? ... View more

Here is the stanza (...\etc\apps\SplunkEnterpriseSecuritySuite\local\inputs.conf). I disabled it for now since it is not working correctly: [threatlist://RansomwareTracker IP] delim_regex = , description = Ransomware Tracker IP fields = description:$3,ip:$8 ignore_regex = (^#|^\s*$) interval = 43200 retries = 3 retry_interval = 60 skip_header_lines = 0 timeout = 30 type = threatlist url = https://ransomwaretracker.abuse.ch/feeds/csv/ weight = 1 disabled = 1 ... View more

I have tried separating domain and ip but still no luck. Fields : description:$3,ip:$8 The lookup is not getting populated: ... View more

Here is my configuration options and results I am seeing in ip_intel lookup. It seems to be wrong .... Type: threatlist URL: https://ransomwaretracker.abuse.ch/feeds/csv/ Weight: 1 Delimiting regular expression: , Fields: description:$4,ip:$8,domain:$5 Ignoring regular expression: (^#|^\s*$) Skip Header lines: 0 ... View more

Thanks all! All of your answers were helpful and let me accomplish what I was looking for. ... View more

that works but it also captures "\" after name and before the comma so it look like "name\, last" any way of removing "\" ? ... View more

Is there an efficient way to extract the two values to one field ? Lets say User(name, last) ? Or should the fields be merged after being extracted? ... View more

These is a default config. It is supposed to filter out events 4662 that contain junk and only leave events 4662 which contain GPO changes ( see for details http://blogs.splunk.com/2014/05/23/controlling-4662-messages-in-the-windows-security-event-log/) GPO changes were done today and I can see these events on Windows Event Viewer on DC. ... View more

No, the regular expression Message="Object Type:\s+(?!groupPolicyContainer)" filters out the junk I am just looking to see Group Policy Changes which I know took place earlier today in the morning and I can see that events within Windows Event Viewer ... View more