If my enterprise AD admins will not allow Splunk Agent on DCs, is DNS Debug logging and Windows Event Forwarding my only option?  Do you have any reference/suggestions regarding this configuration?  Additionally, and read on the article, it seems Stream is the preferred implementation and not DNS Debug. Can you elaborate as to why? Thank you much in advance. ... View more

I would try and use the geostats command to use a lookup file that has your private addresses. The lookup file would need to have the longitude and latitude information in it as well then you just tell the geostats command which field in the lookup file is the longitude/latitude fields. Here is an example search: sourcetype=vendor_* | lookup price_lookup Code OUTPUTNEW product_name | table product_name VendorID | lookup vendors_lookup VendorID | geostats latfield=VendorLatitude longfield=VendorLongitude count by product_name Here is a link to more information: http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Geostats ... View more

If you don't feel comfortable or have direct access to the conf files you can do this also in the web UI Simply put the regex into a transform settings > fields > transformations Then you create a new extraction in settings > fields > field extractions, instead of inline you use tranformation and give the name of the transformation This setup has the advantage that you can use the same regex/transformation in multiple extractions, therefore if the regex changes you only have to fix it once and not in every extraction. you can do most of the changes in the web UI which is mostly good enough, but not all of it.. ... View more

Sorry Jon, This did not work The sample log does not always have a %M for example: August 13, 2013, Hour 1 foobar:A general I will be opening a case. ... View more

You are very close but try this one and see if it works for you: ... | rex field=_raw "\s+http://[a-zA-Z0-9./]+\/(? [^.]+).exe\s+" the lookahead assertion might have been causing problems. I also grabbed everything up to the last slash then the field "exe" is populated with everything that is not a period. Just a different technique but hope this works out for you. ... View more

I am using Splunk Enterprise 6.0.3 and I am having the similar issue. I have created the extraction pattern through a web but don't find a way to save it and use it persistently. All I see in the prop.conf is the name of extraction and other config contains the field names that I have defined. ... View more

HI index=websense OR index=bcoat | transaction src what i understand from output that he grouped the activity(browsed URL's) by src IP. means that source IP browse which URL's... AM I Right...? secondly My actual requirement is that I want to see all the source IP's whos are bypassing websesne means there is no browsing record in websense logs and available in bcoat proxy. I made one query but there is no result displaying.: index=websense sourcetype=websense src NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ] Please advise ... View more

That did it. Tested and I'm now pulling out the IP. Many thanks. ... View more

Back on site today, and temporarily swapped from Local System to a "God" account with local and network permissions. No luck. It does seem to be the ParsingQueue that dies with the IIS logfiles. ... View more

woohoo! this works. I had to to change it slightly to ' | top Security_Template by PositionID ... View more

All right, I got it running. thank you a bunch! ... View more

To explain your three regexes: rex field=host .(?<Farm>(\d{1})) Match any character followed by only one digit. The {1} is unneeded in this particular example as just a \d would be the same. rex field=host .(?<Farm>(\d{2})) Match any character followed by 2 digits. rex field=host .(?<Farm>(\d{1,2})) Match any character followed by a minimum at least 1 digit and up to 2 digits. @bmacias84 did a great job matching the entire string you have provided with the above regex. But yes, you can go to the 6th position in the string fairly easily. Consider the following simple regex: .{5}\d+ It basically says, "lets match any 5 characters followed by one or more digits." For the search syntax, that would be: rex field=host ".{5}(?<Farm>\d+)" ... View more

If that were the case then the initial indexing of the file would have been unsuccesful ... View more

The timechart command has flags that you can give that will limit or expand the number of items tracked on the chart. If you want to eliminate other then there is a flag called "useother=f" and this will remove this bucketing. If you want to increase the default 10 items for the timechart then use the "limit= " flag. Here is an example: ... | timechart span=15m count by EventCode useother=f limit=20 Here is a link for more information: http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Timechart ... View more

Fields extractions are on the search head then if your indexer is the search head too then you should put it there. Your sencond extraction via delims looks right. ... View more

The underlying technology in this App - nfdump - was replaced with a free limited edition of NetFlow Integrator. For high volume of NetFlow records you may consider this App and TA https://splunkbase.splunk.com/app/489/ https://splunkbase.splunk.com/app/1838/ ... View more

Excellent glad you figured your own problem out. ... View more

Yes, you can use Windows TA or simply in the UF inputs.conf, configure the whitelist or blacklist. The whitelist or blacklist functionality exists only from UF v6 onwards. The original post was in 2012, probably at that time, the solution was to do the regex on the indexer or heavy forwarder layer. ... View more

This is exactly what I was looking for! ... View more

no luck so far... here are the three key files. Restarted splunk and no td_nv field even appears.... transforms.conf : [gztdnv] REGEX = \s+(\S+)\s+(\S+)\s+(\S+) FORMAT = td_nv::"$1.$2" WRITE_META = true props.conf : [mylogs] TRANSFORMS-gztdnv = gztdnv fields.conf: [td_nv] INDEXED=true ... View more

You might want to experiment with the SHOULD_LINEMERGE. If you want to use the LINE_BREAKER then you need to add the following: SHOULD_LINEMERGE = true ... View more

index=test ID_STUFF | rex max_match field=_raw "ID_STUFF=(|\S+,)(?.*?)(\s+|&)" | eval ID_VALUES =split(ID_VALUES ,",") | mvexpand ID_VALUES | stats count by ID_VALUES ... View more

Thanks for posting the sample log. That makes it easier. Here is a shot at the search: sourcetype="*WinEventLog:Security" Message="An account failed to log on*" | stats count by Account_Name | where count > 5 | table Account_Name, ComputerName, Workstation_Name You can put any of the fields listed on the left-hand side of the search in your table. ... View more