I am working in an environment where there are several different constituencies. Each has different needs in terms of apps, data? I believe that it would be much easier for a user in a group to be presented with his/her custom environment, at login time, without having to share apps, such as search with everybody else. It appears as if the whole Splunk system is built just for the group. Can you point me to the relevant documentation? Thank you. ... View more

Hello, I have two tables listed below. The small table is a subset of the large table. Large_table Small_table large_source_field small_source_field Account_Domain registry_key_name Account_Name registry_path AddressFamily registry_type registry_key_name registry_path registry_type I like to merge the two tables into a single one (see below) with entries with the same value on the same row After_merging_table large_source_field small_source_field Account_Domain Account_Name AddressFamily registry_key_name registry_key_name registry_path registry_path registry_type registry_type Any help will be much appreciated ... View more

Hi the string "2016-25-11T00:00:0019:47:00" represents the time stamp in a logfile. I can figure that 2016-25-11 is %Y-%m-%d in strptime format T represents the start of the time section but what is the remaining string " T00:00:0019:47:00" in terms of strptime => T%H:%M: and what else? Can you explain what is 0019:47:00? What is the format used here in terms of seconds, milliseconds, etc. I need to extract the time stamp. Thank you. ... View more

Hello, Systems in a COOP'ed environment are rsync'ed from the original systems. As the COOP systems are rsync'ed, the config files include the hashed value of the encryption key. Question: when the COOP systems are activated, will the encryption work as it was in the original environment? Thank you. ... View more

I have the following xml file all in one single line For readibility, the file is shown as follows &ltevent&gt...&lt/event&gt &ltlabel1&gt ... &lt/label1&gt &ltlabel2&gt ... &ltlabel2&gt &ltlabel3&gt ... &lt/label3&gt ... &ltevent&gt...&lt/event&gt &ltlabel1&gt ... &lt/label1&gt &ltlabel2&gt ... &ltlabel2&gt &ltlabel3&gt ... &lt/label3&gt ... In order to parse the xml file, my approach is to first break each event to reside on a single line by itself. As follows props.conf only includes the two statements below (no other statement such as timestamps, etc.) to ensure that events are parsed correctly &#35 To delimit event by event "&ltevent&gt .... &lt/event&gt &#35 Splunk now knows that each event is on a single line LINE_BREAKER = (&ltevent) SHOULD_LINEMERGE = false However this first step - as configured - fails as event splitting falls on some boundary that I have not been able to explain. This happens whether in data preview mode or search mode. BTW, line breaking happens differently in line mode vs search mode. Can someone explain what happens and suggest a solution? Thank you. ... View more

I read 12 questions/answers when searching for conf.conf. I still have no idea of the meaning/purpose of that file. Please help. ... View more

HI We need to remotely install U FWD on thousands of Linux and WIndows systems. On Linux systems, in the installation script, instead of the statement on deployement server listed below /opt/splunkforwarder/bin/splunk set deploy-poll \"$DEPLOY_SERVER\" --accept-license --answer-yes --auto-ports --no-prompt -auth admin:changeme I use the following statement which I believe provides a better practice cp –r all_deploymentclient /fmac/Splunkforwarder/etc/apps where the directory all_deploymentclient includes the following two files +++ host070> more deploymentclient.conf [deployment-client] 10 minutes phoneHomeIntervalInSecs = 600 [target-broker:deploymentServer] Change the targetUri targetUri = x.x.x.x:8089 ++++ host070> more app.conf [install] state = enabled [package] check_for_updates = false +++ How can I replicate the same functionality on Windows servers using Windows scripting? I could not find any such information on http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/DeployaWindowsdfviathecommandline Thank you for your help ... View more

I was in the process of identifying all the authentication config files on my Deployer in a search head cluster environment. The intent is find out all the files that are listed under $SPLUNK_HOME/etc/shcluster/apps/ as they relate to authentication settings on the remote systems. I did: $SPLUNK_HOME//bin/splunk btool authentication list --debug The output listing did NOT show anything about $SPLUNK_HOME/etc/shcluster/apps/ This subdirectory does exist however and shows up using a regular "ls". Have I missed anything about btool? ... View more

I am new to a search head clustering environment. I found macros being used and I am trying to find out where these macros were created. I read the link http://docs.splunk.com/Documentation/ES/3.3.0/Install/Macros which has a lot of useful information on ES defined macros. Is there a way to quickly find out the location of a given macro, e.g., | `host_eventcount(30,72)` using grep at the CLI, or search? This helps me to understand what canned searches do. Thank you. ... View more

We currently have fireeye allerts coming in as log events that will be indexed. Some that are labeled as "malware-object detected" are currently manually processed by our analysts. They collect various fields (source/destnation IPs, time stamp, etc.), and build a query based on other logs (proxy, dns, exchange, etc.) as a way to build a "context" of the possible infection. The idea is to automate this query search process every time a "malware-obeject detected" log is received and indexed. May I get some pointers from you on how to proceed in terms of techniques and documentation? Thank you. ... View more

The syslog messages we receive from the firewall have multiple formats. A limited sample is listed below Apr 30 15:26:20 147.81.86.22 %ASA-4-313004: Denied ICMP type=0, from laddr 10.11.20.59 on interface outside to 147.81.104.109: no matching session Apr 29 13:39:31 147.81.86.22 %ASA-6-605004: Login denied from 72.81.224.40/63508 to inside:72.81.86.22/ssh for user "dstrollo" Apr 28 13:58:47 147.81.37.241 %ASA-3-710003: TCP access denied by ACL from 45.64.188.70/48986 to Internet:72.83.128.9/23 Our requirement is to be able to extract all the fields in these messages for our analysts. My question is whether the configuration below will work. If it doesn't it may mess up the existing index. Any advice will be much appreciated. In props.conf, I set up a basic search to extract the syslog message in each record. The results are listed below Denied ICMP type=0, from laddr 10.11.20.59 on interface outside to 147.81.104.109: no matching session Login denied from 72.81.224.40/63508 to inside:72.81.86.22/ssh for user "dstrollo" TCP access denied by ACL from 45.64.188.70/48986 to Internet:72.83.128.9/23 The props.conf is listed below [syslog] ------- NO_BINARY_CHECK = 1 pulldown_type = 1 BREAK_ONLY_BEFORE_DATE = false TIME_PREFIX = ^ %Y = year, %m = month, %d = day, %H = hour, %M = minute, %S = seconds, %z = time zone offset example = 2015-03-25T16:22:01-04:00 the - ( in -4:00 => %z ) is part of the timezone specification (UTC-04:00 versus UTC+04:00) TIME_FORMAT = %Y-%m-%dT%H:%M:%S%z EXTRACT-syslog = \s(?[^\s]+)\s(?[^:]+:)\s(?.+) Then I use different transforms to process each message type separately at search time In props.conf [syslog] .... EXTRACT-syslog = "as above" REPORT-SyslogMsg = SyslogMsg1, SyslogMsg2, SyslogMsg3 In trasnforms.conf [SyslogMsg1] REGEX = "extract fields in Msg1" SyslogMsg2 REGEX = "extract fields in Msg2" SyslogMsg3 REGEX = "extract fields in Msg3" Thank you. ... View more