Hello all, I am looking to set the sourcetype of my logs based of the logs' source. I know how to do this by modifying the .conf file, but I need to know how to do this from the web console. I know I can set the sourcetype from the monitoring directories, but it won't accept wildcards. Essentially want to get the example below, but via the web console. [source::/file/archive/*BSM*] sourcetype = solaris_bsm Do I have to monitor the directory with a white/black list and then set the sourcetype? The directory I am monitoring will have several different desired sourcetypes in it. Will I have to, for each sourcetype in the directory, have its own data input configured to monitor the directory with the desired white/blacklist regex? Thanks in advance for the help! ... View more

In Enterprise Security, there is a Security Posture dashboard. This dashboard shows the count of notable events that have occurred in the logs. As a result, I have two questions: 1) How do you create the templates for what makes a notable event? Ie. Unknown user logs in, notable event created. 2) How do you show the count of events without having all the queries for each notable event run every time you view that dashboard? I have a feeling the answer to question 1 will help me conceptualize the answer to question 2. So if anyone can at least point me in the right direction, any help is much appreciated! Thank you! ... View more

Hello! I am sure my wording is way more complicated than what I want. Basically, the end result being a stats table along the lines of: Host | AvgLogCount | Min_Total | Max_Total Router1 | Router2 | And then the values filled in from there. The timespan in which I am looking at is 1 week. I was thinking using something along the lines of: index=db device_type=router | timechart span=1d count | eventstats avg(count) as AvgLogCount, min(count) as Min, max(count) as Max When I do this, there are X amount of rows that there are days, with the values matching the next row. I get why that is happening, but I want to turn it into each row listing a different Host, and the rest of the columns' value be of the respective host. Do I need something along the lines of: index=db device_type=router | timechart span=1d count | eventstats avg(count) as AvgLogCount by host, min(count) as Min by host, max(count) as Max by host I think that is on the right track, but it doesn't return anything. Any help would be greatly appreciated! And hopefully my wording makes sense. Thank you! ... View more

I am indexing a couple hundred Solaris 10 BSM audit files a day. The audit files are converted to ASCII. It handles the indexing and host assignment just fine, but when it comes to the sourcetype, it gives me all sorts of crazy results. I have the sourcetype be assigned automatically during the index. There are many field extractions that I want to configure but it would be illogical to use the automatically assigned sourcetypes as it would take 2-3 fields per host. And due to the volume of sources, it wouldn't make sense to assign them by host either. Example of what sort of sourcetypes I am seeing would be HostnameA's audit file would not only have a sourcetype of another Hostname, but the logs within that audit file would be assigned (what seems like randomly) to HostnameB-2 and HostnameB-3. Hopefully this all makes sense, it is a rather frustrating issue. Any help would be greatly appreciated! ... View more