Is this still valid? In my classic dashboard I don't see this field.  ... View more

Nine years on...    is it possible yet to define field extractions for particular eventtypes  ? Defining them  on a sourcetype basis is too generic... one extraction does not fit all events for a given source type. Example.  -    Linux file  /var/log/secure   contains Username in different places for successful login and for failed login...   so two extractions are required for the same field  "Username"   Is this a reliable way to do it... ?   Will the extractions conflict or will the results just be merged? ... View more

Try the updated answer. I believe the output series will be like "CPU_Util%:hostName". ... View more

You are correct, there is not a replacement for the IPS app that provides an SDEE feed. You can use the current deprecated version, but you may need to patch it yourself. More info here: http://answers.splunk.com/answers/105193/cisco-ips-error-errno-8/135759 ... View more

So how do I insert and center my own logo? This was clearly explained for v5, now its broken and now explanation on how to fix it. ... View more

You can do this in two ways: First, email the alert sending the results of the alert (it's just a setting in the web form). Second, have the alert run a script on the Splunk server that then parses the results file (the location of which is found in the environment variable SPLUNK_ARG_8 the script (in whatever language) can access). After pull out only the data you want, have the script send mail, run processes, or do whatever else you need to parse it. Look for more variable info at http://docs.splunk.com/Documentation/Splunk/6.0/Alert/Configuringscriptedalerts ... View more

And if required: in advanced XML dashboards you can calculate the value for span based on the selected time range. So if the user searches over the last 24 hours, you could set the span to 1h, if user searches of the last 30 days, span could be 1d. ... View more

Can you paste the full contents of your pySDEE.py file to pastebin, and link here? I'll check for any issues with it. Also, did you restart splunkd after editing? ... View more

Please explain the process of installing of Cisco firewall apps. I am still could not install it. ... View more

Hi Matthew, How did you get on here? Like @linu1988 said, the Splunk_CiscoFirewalls app is essentially a Technology Adapter (TA) that parses inbound syslog data from Cisco firewalls. In doing so it overrides the sourcetype of the data and performs field extractions that allow the Cisco Security Suite app to populate it's dashboards. By disabling/deleting the Splunk_CiscoFirewalls app, you should no longer see the saved searches, field extractions, etc. Cheers 🙂 RT ... View more

Im also struggling with this... Would be good if a) the logs were not collected at all... just imported straight to the index b) the logs were located in the /var/log folder... and managed with normal unix logrotate... anyone know how to do either of those things...? thanks ... View more