I have a list of URLs in my website that is critical. So, I have marked all those URLs with a tag::critical using eventtype. However, I am unable to use tag field to filter data within the datamodel. So, I want to setup a field called content_priority that should have value of "critical" if the event has a critical tag , else set the field value to "normal" . I have configured a calculated field with following eval expression: if(tag=critical,"critical","normal") However it does not seem to work at all. So, I am stuck with it now. Any guidance would be much helpful and appreciated. ... View more

Hi guys, I am unable to run tstats command against the sub-dataset in a datamodel. Whenever I try to, it throws below error: Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel I am not even using the summariesonly in my query for the Datamodels to be accelerated. (Its accelerated though..!!). | from datamodel:Intrusion_Detection.Network_IDS_Attacks | stats count Above query gives me right answer, however when I use tstats like in below query, it all goes haywire. | tstats count from datamodel=Intrusion_Detection.Network_IDS_Attacks Could someone point out to me what is it I'm doing wrong? ... View more

Hi Guys, I have built the Authentication datamodel on the Splunk ES. However I am dealing with a dilemma of duplicate events here. To explain it in detail: If an authentication attempt occurs from src X to dest Y, same event is generated on X, Y and Domain Controller A. I am collecting logs from all the three machines and adding the same into the datamodel. So, when I use tstats count against the datamodel, I see 3 events depicting 3 attempts instead of one. The only way I see out of removing this duplicate is by adding src or host as an additional separator. If so, I won't be able to monitor the criteria of login failures from multiple sources. So, I was just wanting to know how you guys are tackling it. Thanks in advance. ... View more

We are planning to decommission the existing Firewall Health Monitoring Tool due to circumstances. We are looking for any solution available for ASA health monitoring through either Splunk itself or an app from Splunkbase. Any suggestions would be of much help. ... View more

I have 2 indexes that have 2 different parts of same data. One index contains http connection details and another contains it's corresponding application data. Index=HTTPDMZ field1=ipadd - Source IP Address field2=sessionid - Session ID field3=url - URL Link index=APPDMZ field1 = Session - Session ID field2 = url - URL Link field3 = user - Username I need to export a comprehensive report with following fields: ipadd sessionid user url I have tried the coalesce command and also merging 2 field names (eval correlation_field=case(isnotnull(sessionid), sessionid, isnotnull(Session), Session, 1=1, "unknown") | stats values(url) as url values(user) as user by ipadd correlation_field . Both haven't worked out for this case. Any other solution will be most helpful. ... View more