From my threat intel source, we tried to forward the intelligence source to Splunk ES-> Threat Intelligence The raw intelligence files has all the fields including the "Organisation", however in ES , it only shows a subset of the fields. May I know how can I include the "Organisation" field in ES? ... View more

For some reason, 1 liner entries are send to my splunk, after incapsula logs shifted to LEEF format. Initially, we were using CEF format. sourcetype:incapsula 1 liner log entries look like this: startTime:xxxxx startTime:xxxx endTime:xxxxxx Vendor is unable to change on their end, anything we can do the Splunk side, to make it such that the entries can be recognized by Splunk? ... View more

eg. I have many logs forwarded to the syslog server. I intend to install a universal forwarder on that syslog server to forward to splunk. However once forwarded to Splunk, what will be the sourcetype? Can my checkpoint server logs be recognized as sourcetype=cp_log in Splunk or is it syslog? I tried just uploading the log file in splunk with sourcetype=cp_log, it does not recognize the format. Log entry format is as follows: Checkpoint xxxx -[action:" xx",flags:"xxx", ifdir:"xx",etc ] ... View more

I have the infra as shown below: Splunk Log Forwarder-> Splunk Indexer The Log forwarder defines which data goes into which index, which is configured at Log Forwarder, Data Input -> Files/Directories. The data(email text file) goes into the directory , then the forwarder forwards to the correct index. Note: Email texts do not conform to any Common Information Model, when it goes into splunk indexer, it will be just text. At the Log forwarder, there is a list of props.conf and transforms.conf to tell it how to look for regexp and extract the fields . However, if new content and regexp changes, it will not be able to detect it. Is there any intelligent way to know what fields to extract the fields(if the lines have this format xxxx followed by semi colon) eg. Sent: Feb 19 2019 10:00 -> reported_time(field): Feb 19 2019 10:00 Reported issue: issue1-> reported_issue(field): issue1 user:xxx -> affected_user(field): user Is this the correct way to extract the fields at the log forwarder? Or it could be done at the Indexer, so that if the regexp changes, I just need to update, and the fields will be re-extracted accordingly. ... View more

I have downloaded the app from https://splunkbase.splunk.com/app/925/ I tried going to Lookup-> Upload csv file Then I tried going to the app, but it shows 0. What kind of data input does the app expect? How does the app work? ... View more