We have a Splunk instance here at my job that I've inherited. I rarely have to go do anything in it so my Splunk Fu is definitely lacking. We're looking at some new public file transfer appliance and need to know something kind of odd for licensing (according to my manager anyway). My manager wants to know, which 60 day period has the highest number of unique user id's that successfully authenticated over the last 2 years. Seems odd that someone would come up with a licensing framework where that matters but I do what I'm told... Here is an example of our current FTP logs when a user successfully logs in: 2012-06-26 22:55:39 dest_ip 21 2172 source_ip 4964 3248 Username 0 0 - 18 RESPONSE: 230-Welcome Username from dest_ip. I have custom fields setup for source, destination, and username. What I'm having trouble grasping is how to I look for the top 60 days over the last 2 years. Any help would be greatly appreciated. ... View more

Sorry for spamming this board (or so it feels like) but I have one more question before the weekend. This may not be even possible.... but I'm working on generating a list of IP addresses and user names that use them so we can create a white list for our FTP server. I had this list completed and thought I could call it weekend... After I sent the list over to the security folks, they requested I have the most recent date that the combination of source IP and and user name was used. When adding the date field to my counted list of results, I get (obviously), a line for every time a source IP, user name, and date are the same. Is there a way I can keep the uniqueness of the source IP and user name while having the most recent date the two were used in conjunction added to the end? Here is the search I'm using: index="ftp" host="host" "bPasswordOK=1" | fields user, src_ip, log_date | stats count by user, src_ip, log_date | sort -count ... View more

Was hoping I could get some help with extracting a field. I have a line that looks like: "2010-10-08 16:04:10 0.0.0.0 21 3236 255.255.255.255 22821 2312 username 0 0 - 22 Back from VerifyPassword(user=username), bPasswordOK=1, iRetCode=0" I want to extract the 255.255.255.255 as src_ip. I understand how to extract the field but I can't come up with a regex that extracts only that second IP address (as it's the source, first is the destination and is always the same, of course these are made up in this example. I don't have broadcast addresses logging into my server). I even downloaded regexbuddy but I still can't figure it out because I'm lame. Any help would be greatly appreciated. ... View more