First of all, can UF's send syslog to a third party? The documentation says, "You can configure a forwarder" but does not specify. It also says "You can also filter the data with props.conf and transforms.conf (heavy forwarder only)". That is NOT what i want to do. The UF is already forwarding to an Indexer, now i need it to send everything to a third party IDS via syslog. I've tried variations of the example here but haven't had any luck. I think my main issue is not fully understanding the relationship between props, transforms, and outputs. outputs.conf [syslog:what_should_go_here?] server=10.x.x.x:514 type=udp I need to send everything to the IDS and don't want to do any filtering, therefore i don't think i need a transform. But do i still need to make a group in props? Thanks ... View more

Hi all, Running Splunk 4.1.8 on Windows. One of our teams wants us to send alerts to their pager, and they are requesting plaintext only, however we want to keep all of our other alerts html. After some reading, I created a different sendemail command in commands.conf and have it calling a modified sendemail.py file. If this will work, what do i need to change in the sendemail.py file to make it plaintext? Also, if i can get that to work, what is the command i would use in the search to only send if there are results? ... | sendemailtest to=mailaddy.com subject="Splunk Alert: end of world" sendresults=true server=mail.domain.com Thank you in advance for your help. I-Man ... View more

Hello all, We have Nessus running on a Linux server which also has a Splunk Heavy Forwarder 4.1.8. We have the Nessus reports going to a certain directory which Splunk Monitors locally and sends to our Indexer. The results are in this format when they reach the indexer: results|domain.com|nessus.domain.com|general/tcp|19506|Security Note|\nSynopsis :\n\nInformation about the Nessus scan.\n\nDescription :\n\nThis script displays, for each tested host, information about the scan itself:\n\n - The version of the plugin set\n - The type of plugin feed (HomeFeed or ProfessionalFeed)\n - The version of the Nessus Engine\n - The port scanner(s) used\n - The port range scanned\n - The date of the scan\n - The duration of the scan\n - The number of hosts scanned in parallel\n - The number of checks done in parallel\n\nSolution :\n\nn/a\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nInformation about this scan : \n\nNessus version... I would like to remove the line break characters (\n AND \n\n) so i can create fields with for Description and Synopsis. I'm thinking this will involve a props and maybe a transform however I haven't been able to find any documentation on how to do this. Thanks in advance for any help! I-Man ... View more

All, We have three 4.1.8 forwarders that send to an indexer. Is there anyways we can determine from the indexer, which forwarder sent which logs? Maybe there is a way to tag each log on the forwarder level so we can search for those tags on the indexer? FYI, we are not doing any indexing on the forwarders, they are forwarding logs only. Thanks in advance for any help! Thanks, I-Man ... View more

We have a Universal Forwarder on a Domain Controller (DC) that is forwarding all the local logs to a 4.1.7 Forwarder. The 4.1.7 Forwarder is then sending the logs to an Indexer, as well as an IDS via syslog. This 4.1.7 Forwarder is also collecting tons of WMI logs which are being observed on both the Indexer and IDS. We are seeing the DC logs come across to the indexer however we are not seeing any of the DC logs go to the IDS. As the Universal Forwarder sends cooked data I tried setting cooked data to false: This is the Universal Forwarder config. /etc/system/local/outputs.conf [tcpout] defaultGroup = splunk02..._9998 disabled = false indexAndForward = 0 [tcpout:splunk02..._9998] server = splunk02...:9998 [tcpout-server://splunk02...:9998] sendCookedData=false After this change I was still able to observe DC logs on the Indexer however none on the IDS. For troubleshooting purposes i installed a LightForwarder on the DC and was able to see DC logs on both the Indexer and the IDS. This leads me to believe that the data is getting cooked by the Universal Forwarder. Anyone have any ideas on how to make the Universal Forwarder send data unCooked or see what im doing wrong here? Here is the config on the 4.1.7 Forwarder /etc/system/local outputs.conf [tcpout] disabled = false indexAndForward = false [syslog:my_syslog_group] disabled = false server = 10.x.x.x:514 type = udp sendCookedData = false props.conf [host::*] DATETIME_CONFIG = NONE TRANSFORMS-ROUTING = send_to transforms.conf [send_to_AG] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = my_syslog_group Thanks, I-Man ... View more

I was testing the Universal Forwarder on my local machine and sent the local eventlogs and perfmon stats to our 4.1.7 indexer. After a little troubleshooting getting the data to the right index I observed the logs fine. As it worked I turned it off the Universal Forwarder and moved on. A few days later I noticed a major increase in logs from our indexer. It appears that the Universal Forwarder turned on the CPUTime, Memory, LocalProcess, etc. checks on the indexer itself. In the GUI these are found in Manager\Data Inputs\WMI Collection. I turned these checks off as they are unnecessary however I'd like to know if anyone else had this problem or knows why this happened. Just putting this out there as it seems odd. Thanks, I-Man ... View more

We have a search that captures the count per host every 10 minutes and puts the results into a summary index. For some reason an event for a single host count during a 10 minute time period was indexed 27 times. Every event is exactly the same. So in order to correct our stats, 26 of these events need to be deleted...How do i do that? I tried: ... | head 26 | delete This returned an error: Error in 'delete' command: This command cannot be invoked after the non-streaming command 'head'. Again, I have 27 events that are exactly the same. How can i delete all except 1? Thanks in advance for any help. I-Man ... View more