I want to send indexed data to another server but I'm running into an error of unable to create/find path. Q: Is this a permissions issue? Q: Maybe this is a syntax error? ….. Any advice would be helpful. Thank you! Info: - Windows 2016 environment - I have two servers setup with UNC paths of \\server01\hotwarmstorage and \\server02\coldstorage that use a service account credential (ie svcSplunk) to gain access. - Splunk is installed using the SYSTEM account. - I've tried to use the UNC path and also mapped the storage drives to Y: and Z: on the indexers and master - While on the indexer and in CMD I can do y: to access the network path Errors: 1) Failed to create directory 'Y:\hotwarmstorage\index-test\db' (The system cannot find the path specified.); 2) \\server01\hotwarmstorage\index-test\db' (The specified path is invalid) 3) I've tried a non-credentialed network path  \\server03\splunkstorage and I get an error '\\server03\splunkstorage\index-test\db' (Cannot create a file when that file already exists.); Master indexes.conf attempts Attempt 1): [volume:seam_test_hotwarm] path = Y:\hotwarmstorage Attempt 2): [volume:seam_test_hotwarm] path = \\server01\hotwarmstorage Index -  indexes.conf: [index-test] repFactor = 0 homePath = volume:seam_test_hotwarm/index-test/db   ... View more

Hello, I've installed the Linux Auditd app https://splunkbase.splunk.com/app/2642/ and I'm pulling auditd logs into Splunk. Once a user goes into root "su root", the events are logged by the app but I can't group the events together with the corresponding user. Other questions about the app suggest this should be done out of the box, so I guess there is something I need to change. I am interested in results similar to when we run "ausearch -ui" where the elevated "su -" events are grouped together with sudo and regular events by a/uid. Any advice or links to knowledge are appreciated! Thank you, -Sean I have run through the configure option within the app and everything seems to be populating correctly. --------------- sample log ----------------- 2020-04-20T14:13:28.243-0700 type=PROCTITLE msg=audit(1587417208.243:33451): proctitle=636861747472002B61002F726F6F742F2E626173685F686973746F72792E616C696D6D2D61 2020-04-20T14:13:28.243-0700 type=PATH msg=audit(1587417208.243:33451): item=1 name="/lib/ld64.so.1" inode=155 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL 2020-04-20T14:13:28.243-0700 type=PATH msg=audit(1587417208.243:33451): item=0 name="/usr/bin/chattr" inode=405135 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL 2020-04-20T14:13:28.243-0700 type=CWD msg=audit(1587417208.243:33451): cwd="/root" 2020-04-20T14:13:28.243-0700 type=EXECVE msg=audit(1587417208.243:33451): argc=3 a0="chattr" a1="+a" a2="/root/.bash_history.ali12" 2020-04-20T14:13:28.243-0700 type=SYSCALL msg=audit(1587417208.243:33451): arch=80000016 syscall=11 success=yes exit=0 a0=1ca3b8d0 a1=1ca4dd20 a2=1ca4a0b0 a3=3ffa0d79710 items=2 ppid=55675 pid=55721 auid=1503413 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=602 comm="chattr" exe="/usr/bin/chattr" key=(null) 2020-04-20T14:13:28.243-0700 type=PROCTITLE msg=audit(1587417208.243:33450): proctitle="logname" 2020-04-20T14:13:28.243-0700 type=PATH msg=audit(1587417208.243:33450): item=1 name="/lib/ld64.so.1" inode=155 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL 2020-04-20T14:13:28.243-0700 type=PATH msg=audit(1587417208.243:33450): item=0 name="/usr/bin/logname" inode=405524 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL 2020-04-20T14:13:28.243-0700 type=CWD msg=audit(1587417208.243:33450): cwd="/root" 2020-04-20T14:13:28.243-0700 type=EXECVE msg=audit(1587417208.243:33450): argc=1 a0="logname" 2020-04-20T14:13:28.243-0700 type=SYSCALL msg=audit(1587417208.243:33450): arch=80000016 syscall=11 success=yes exit=0 a0=1ca38c60 a1=1c912b90 a2=1ca4a0b0 a3=3ffa0d79710 items=2 ppid=55719 pid=55720 auid=1503413 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=602 comm="logname" exe="/usr/bin/logname" key=(null) 2020-04-20T14:13:39.293-0700 type=PROCTITLE msg=audit(1587417219.293:33452): proctitle=617564697463746C002D6C 2020-04-20T14:13:39.293-0700 type=PATH msg=audit(1587417219.293:33452): item=1 name="/lib/ld64.so.1" inode=155 dev=fe:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL 2020-04-20T14:13:39.293-0700 type=PATH msg=audit(1587417219.293:33452): item=0 name="/sbin/auditctl" inode=420444 dev=fe:00 mode=0100750 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL 2020-04-20T14:13:39.293-0700 type=CWD msg=audit(1587417219.293:33452): cwd="/root" 2020-04-20T14:13:39.293-0700 type=EXECVE msg=audit(1587417219.293:33452): argc=2 a0="auditctl" a1="-l" 2020-04-20T14:13:39.293-0700 type=SYSCALL msg=audit(1587417219.293:33452): arch=80000016 syscall=11 success=yes exit=0 a0=1ca5f0b0 a1=1ca5e8f0 a2=1ca778a0 a3=3ffa0d79710 items=2 ppid=55675 pid=55727 auid=1503413 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=602 comm="auditctl" exe="/usr/sbin/auditctl" key=(null) ... View more

Basically, when I try to search for mf4 values on their own, index="sean-testing" mf4=w, the data found is zero or blank but if I use the full search with rex as seen below then click the mf4 value from the table view, the full event data will come up. I use regex101.com to drop the rex into the expression line and the data sample, one at a time, into the test sample box to test things out. *Q: I'm thinking that I need to place this field extraction in a promps as a report or extract on the indexers? * Any advice, examples or links to a better understanding would be great! Thank you. -Sean full Search with rex index="sean-testing" sourcetype="mfsource1" | rex "\s{2}(?P<mf1>\d+)\s(?P<mf2>.{8})\s(?P<mf3>\S{10}){1}(?P<mf4>\S+)\s(?P<mf5>.+)[0-2][0-9]:[0-9][0-9]:[0-9][0-9]$" | search mf4=W OR mf4=I | table _time mf1 mf2 mf3 mf4 mf5 Event Data Sample 1 200401 07595444 17476 CARDS5 EXSFJM1083I EJM1: Using LWASP provider module "LWASP32.DLL", from API version 2009 07:59:54 Event Data Sample 2 200331 18250270 1764 CARDS1 CASHO00200I AB2P XA interface loaded. Name(AB2 for WINDOWS), Registration Mode(Dynamic) 18:25:02 Event Data Sample 3 200331 18250131 6508 CARDS3 CASZS50110W Failed to open port 21661 for TCPIPSERVICE ZTGIPP1 18:25:01 sourcetype Basic stuff - break at everyline, no regex added ... View more

I am looking for guidance and advise for setting up limits and/or ulimits like settings for a Windows server 2016 installation. I've modified ulimits in a Linux installation(just set unlimited) but i'm not quite clear if this is a thing in a Windows install. The plan is to pull in a 2-3 eventID from the security WinEvent logs for phase 1 while pushing down .conf files and the Windows_TA app. Future phases will be to increased the WinEvents data-in logs. Q: Do I need to worry about "ulimits" or the similar setting in the Windows environment? For Splunk core and Forwarders? Q: Do I need to modify the ulimits like feature in all of the windows components and forwarders or just the indexers? Q: I'm assuming I will be able to push the limits.conf down to the forwarders if I need to set those limits? Q: I've modified the phone_home to 5 minutes. Should I expect a huge bandwidth spike in phase 1 or phase 2 Q: Any other configurations I should review to make this deployment smoother and/or not crash the gibson? Current Environment: 1xSH(WIN) 2xIndexer(WIN) (distrubuted, load balanced by time, not clustered), 1xMaster(WIN) 1xDeployment(Linux) 1xHeavyForwarder(Linux) I am deploying in two phases. 1st phase is 400-500 Windows forwarders - pulling 2-3 eventIDs 2nd phase is 4000 Windows forwarders - pulling 2-3 eventIDs Thank You, Sean ... View more

After running the splunk list monitor command from a s390x sles12 machine, it runs the command fine but displays 8 rows of entries in the post status lines saying ""request for members failed failed!" ... Does anyone know what that means? ServerHostName:/opt/splunkforwarder/bin #./splunk list monitor Splunk username: admin Password: Request for members failed failed! Request for members failed failed! Request for members failed failed! Request for members failed failed! Request for members failed failed! Request for members failed failed! Request for members failed failed! Request for members failed failed! Monitored Directories: [No directories monitored.] Monitored Files: $SPLUNK_HOME/etc/splunk.version /var/log/audit/audit.log ... View more

I would like advice on how to unset my dashboard token whenever a new search timeframe is selected using the timepicker. Thank you <form> <label>Dashboard Example</label> <fieldset submitButton="false"> <input type="time" token="time1"> <label></label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> ... View more

I'm trying to configure a time-based lookup (temporal lookup) but it doesn't seem to be working as expected. Any advice would be great. Thanks! I'm using the Expiration field to configure time-based lookups. 1) I've tried with and without the _offset parameters . 2) Table and definitions Permissions are set to App. 3) The definitions fields are: Expiration,Common_Name,Organization,Organization_Unit,Serial_Number,Email Address 4) The transforms.conf is on the SH transforms.conf [ICA_Definitions] batch_index_query = 0 case_sensitive_match = 1 filename = 2018_ICA_Certs.csv time_field = **Expiration** time_format = %m/%d/%Y %H:%M max_offset_secs = 10 min_offset_secs = 0 ... View more