I'm struggling to find the proper regex to adjust the blacklist for 4662 events. I want to blacklist all 4662 events unless they are related to group policy or DNS. I've tried a number of combinations. My latest running example is: blacklist1 = EventCode="4662" Message="Object Type:\s+(?!(groupPolicyContainer|dnsNode))" Using this I get back no 4662 events. So far while trying to research and understand RegEx I haven't figured out how to make this work. ... View more

I have events that do not extract the fields from the message field by default. I'm trying to setup props/transforms to auto extract the fields on search. I believe I have the props and transforms setup properly however it's not working. I think the issue is the regex I'm using and possibly the first 2 lines of the message data. Props: [source::WinEventLog:Directory Service] REPORT-dsfields = ds_fields Transforms: [ds_fields] SOURCE_KEY = Message REGEX = ([^:]+):\n(.*[\S]) FORMAT = $1::$2 MV_ADD = true KEEP_EMPTY_VALS = true The regex appears to extract the fields properly with the exception of the first line which I don't need. I also tried this regex (?:.*\n){2}([^:]+):\n(.*[\S]) Which also appears to work to exclude the first two lines. However the combination doesn't extract fields when searching. If I extract a single value in the same props and transforms it works so I believe the files are configured properly. I don't care if the first line (Internal Event:) is extracted or not. The goal is to extract the field value pairs in the rest of the message. The message field data looks like: Internal event: A client issued a search operation with the following options. Client: 10.215.215.215:61759 Starting node: DC=domain,DC=Domain,DC=Domain,DC=local Filter: (accountNameHistory=*[DG]*) Search scope: subtree Attribute selection: accountNameHistory,employeeType,title,info,groupType,distinguishedName,objectGUID,sAMAccountType,departmentNumber,memberOf,objectSid,objectClass Server controls: Visited entries: 1556 Returned entries: 8 Used indexes: Ancestors_index:3356:N; Pages referenced: 16745 Pages read from disk: 31 Pages preread from disk: 9 Clean pages modified: 0 Dirty pages modified: 0 Search time (ms): 313 Attributes Preventing Optimization: accountNameHistory User: Domain\some-user-account ... View more

At Conf 2016 the team at the Cisco booth showed me I can get URL data with estreamer and It was my understanding we can get everything from estreamer that we can with Syslog. We were using Syslog to get the web traffic (users/ urls) but had to move away from that method. Estreamer has the web data as far as the URL under the flow statistics but doesn’t appear to contain the user information. The user field for flow stats is a numerical number, most hits being 9999999 or 9999997. The syslog data had the actual username and we could report on per user data. We are running version 6.0.1-2 for SourceFire. The options for EStreamer on the Sourcefire configuration has all data selected as being available. We’re running estreamer 2.2.2 on Splunk 6.4.2 with the options for log extra data, log flows, and log metadata enabled. It actually seems like all of the estreamer data has a number for user. Is this the expected data format and is there way I can translate number to user (assuming the number represents a user in SourceFire). ... View more

I’m trying to report on the time difference between two related events. Both events are collected from Windows event log and are in the same index. They will occur on the same host but at different times and IDs. Example event data: Time: 3/11/2016 9:00:45 PM EventID: 1000 Source: Backup Agent Message: Backup Started Host: Server1 Time: 3/12/2016 1:09:45 AM EventID: 1001 Source: Backup Agent Message: Backup Completed Host: Server1 The second event can occur any time after the first, maybe in a few minutes or a few hours. I’m thinking I need to find event 1(1000) first and then look for the first occurrence of event 2 afterwards. The index would contain similar events from many hosts around the same time. I’ve tried various attempts with joins, transactions, and subsearches and searching the documentation for suggestions with no luck. I’m really not concerned with any of the data in the event other than the time (which I would eval to a start and end time). The goal is to be able to run a report over a time span to show the start/end times for each host. This gets me close but doesn’t scale to multiple hosts/time ranges: index="wineventlog" SourceName="Backup Agent" (EventCode="1000" OR EventCode="1001") | transaction maxspan=4h startswith=(EventCode="1000") endswith=(EventCode="1001") | table host,duration ... View more

I’m trying to pull a CSV file into Splunk with the fields extracted at index-time. My environment consist of multiple indexers with a master node, single search head, and a forwarder where the CSV file is at. On the master and all the indexers is a props.conf: [CSVData] FIELD_NAMES = “Field1”, “Field2”, “Field3”, “Field4”, “Field5”, “Field6”, “Field7”, “Field8” FIELD_DELIMITER = "," INDEXED_EXTRACTIONS = csv CHECK_FOR_HEADER = false KV_MODE = none NO_BINARY_CHECK = false SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = TIMESTAMP pulldown_type = true On the forwarder I have an inputs.conf: [batch://C:\CSV] disabled = 0 move_policy = sinkhole followTail = 0 index = csvindex sourcetype = csvdata The data is picked up and indexed. However when I search for the data in the index the fields are not extracted. All of the CSV data is just a ‘glob’ in the event. The props.conf above is an example of the CSV fields. The actual CSV has 34 columns in it, the props.conf includes all of them on my servers. Not all rows have data in each column. The props.conf works when I try to input data manually from the web interface (time and fields are extracted properly) and this similar setup works in a single node test environment. I suspect I’m missing a piece to the configuration in the multi-node environment I’m in now. ... View more