I am looking to do a search every minute, and see if there are more than 5 events from a specific user. If so, I need to trigger an alert. I have this running as a scheduled search every minute, and it seems to be working. Is there a better way to do this? Should I be scheduling the search every hour and look for login events >5 in 1 minute windows? If so, how would I do that. My current search looks like this user=* | eventstats count by user | where count > 5 start time -6m finish time -5m run every minute ... View more

I am executing the following search and it is taking a long time to execute. Is there a way to save the results of parts of a search so that when I modify the tail end I don't have to run the whole search? I.e. can I save the results of user=* | dedup _ raw and then run those saved results through subsequent searches? user=* | dedup _raw | transaction user date_minute date_second ... View more

I am trying to chart different types of login events. I believe that the fields were extracted by the *nix app in logs from /var/log/secure. For example, if I have 100 events, I have found that I can group them into non overlapping groups that total to 100 in the following way: eventtype=failed_login vendor_action=session open vendor_action=accepted I can create 2 new event types to cover session open and accepted. I want to be able to do something like "stats count by eventtype" but eventtype alone generates overlapping groups of events since one event can have multiple eventtypes. Is there some way I can eliminate the unwanted event types? ... View more

How do I select different sourcetypes for multiple logs coming from multiple servers (no universal forwarders, using rsyslog.conf)? When I set up the input port, it only offers one type of sourcetype choice. ... View more

I have seen that Splunk App for Unix extracts the user field from /var/log/secure logs. This appears to be working fine on my desktop Linux workstation. If you look below, you will see a list of the settings>data inputs>local inputs>files and directories. If you look at the last line, it indicates it is monitoring /var/log/secure, has source type linux_secure, and app is SA-nix. I believe this is what is extracting the user field out of the /var/log/secure logs. I tried doing the same thing on another server with the Splunk App for Linux and do not see this line in the inputs, only the line with /var/log. I assumed it was configured by the Splunk App for *nix. Can you tell me what I am doing wrong? I tried manually adding it, but it does not provide SA-nix as an application option. Also, would like to be able to do this processing from forwarded logs from other servers. We have the logs forwarded via the rsyslog.conf file on port 514 from multiple servers, and are not using universal forwarders. Can you tell me how to configure the servers so that the user field will be extracted? Full path to your data Set host Source type Set the destination index Number of files App Status Actions $SPLUNK_HOME/etc/splunk.version Constant Value splunk_version _internal 1 system Enabled | Disable $SPLUNK_HOME/var/log/introspection Constant Value Automatic _introspection 15 introspection_generator_addon Enabled | Disable $SPLUNK_HOME/var/log/splunk Constant Value Automatic _internal 43 system Enabled | Disable $SPLUNK_HOME/var/spool/splunk Constant Value Automatic default system Enabled | Disable $SPLUNK_HOME/var/spool/splunk/...stash_new Constant Value stash_new default 1 system Enabled | Disable /Library/Logs Constant Value Automatic os Splunk_TA_nix Disabled | Enable /etc Constant Value Automatic os Splunk_TA_nix Disabled | Enable /home/.../.bash_history Constant Value bash_history os Splunk_TA_nix Disabled | Enable /root/.bash_history Constant Value bash_history os Splunk_TA_nix Disabled | Enable /var/adm Constant Value Automatic os Splunk_TA_nix Disabled | Enable /var/log Constant Value Automatic os Splunk_TA_nix Disabled | Enable /var/log/secure Constant Value linux_secure default SA-nix Disabled | Enable Delete ... View more

I have logs that do not use the default name value format for the user field. When I add a field extractor for my user format and name it "user", the default format of "user=" no longer is included in the search. How to I add to the existing field rule rather than replace it? ... View more