Thanks for the answer, it did the trick. I've adjusted the search as: `event_sources` | fillnull | eval Type=if(Keywords=="Audit Success",Keywords, Type) | eval Type=if(Keywords=="Audit Failure",Keywords, Type) | search ((Type="Error" OR Type="Warning") OR (Type="Denial" OR Type="Audit Failure")) | stats earliest(_time) as First latest(_time) as Last max(Message) as Sample_Message count by host, EventCode, SourceName, Type | eval First=strftime(First,"%x %X") | eval Last=strftime(Last,"%x %X") | sort -count host, EventCode, SourceName, Type | rename EventCode as "EventId" | table host,EventCode,SourceName,Type,First,Last,Sample_Message,count and the date is shown in the report as expected. ... View more

Hi, Can you confirm that you have the Splunk Add-on for Cisco ASA installed? This creates the sourcetype and the parsers that are needed to extract the required fields from the ASA logs. If this is installed correctly, the indexed events should indicate cisco:asa as sourcetype . If the add-on for Cisco ASA is installed, the next step is to confirm that you do have entries in the associated index. When you launch the Firegen for Cisco ASA app for the first time, it will ask you to specify the index used for the ASA logs. Verify that the index used by the FIregen app is the one where the logs are (you can rerun the Setup from the Managed Apps page): This sets the cisco_asa_index macro that is used by the FIregen app. Please verify these two things and then let us know if it still doesn't work so we can troubleshoot it further. ... View more

It is showing the number of distinct destinations for each group of 2 minutes for the selected time interval. Maybe renaming the dc(dest) as conns and the use of bar graph were not that inspired. Here is a search with a different visualization that is probably easier to read: <your search> | bucket _time span=2m | stats dc(dest) as destinations by src _time | where destinations > 4 | table _time, src,destinations | sort -_time This should return a _time sorted table similar to: _time src destinations ------------------------------------------------------------------------------- 2017-12-08 21:14:00 192.168.1.211 13 2017-12-08 21:14:00 192.168.1.212 5 2017-12-08 21:14:00 192.168.1.216 7 2017-12-08 21:14:00 192.168.1.227 34 2017-12-08 21:14:00 192.168.1.35 6 2017-12-08 21:12:00 192.168.1.200 9 2017-12-08 21:12:00 192.168.1.210 14 2017-12-08 21:12:00 192.168.1.211 12 2017-12-08 21:12:00 192.168.1.212 9 2017-12-08 21:12:00 192.168.1.227 15 2017-12-08 21:10:00 192.168.1.200 13 2017-12-08 21:10:00 192.168.1.211 20 2017-12-08 21:10:00 192.168.1.227 14 2017-12-08 21:08:00 192.168.1.200 14 2017-12-08 21:08:00 192.168.1.210 12 This is showing the sources accessing more than 4 destinations for each group of 2 minutes for the selected time interval. If you also want to see the actual destinations for each source, you can use eventstats and mvcombine: | bucket _time span=2m | eventstats dc(dest) as destinations by src _time | where destinations > 4 | table _time, src,dest,destinations | mvcombine dest | sort -_time ... View more

You need to use the bucket command: your_search... | bucket _time span=2m | stats dc(dest) as conns by src _time | where conns > 4 You need to adjust the source and destination fields accordingly. Here is an example from one of my indexes showing sources (src) that had more than 4 distinct destinations (dest) within a 2 minute bucket for the last 15 minutes. As you can see, you will get stats for each time interval bucket for the entire time interval selected (so for every 2 minutes, you will have a list of hosts with more than 4 distinct destinations): ... View more

Just to get an idea, roughly how many events, distinct files and computers are you looking to analyze in a typical job? If there are so many files that the iterative approach used by map/append is not performant, maybe we can look into a custom Python script as a lookup that would receive an array with the sizes of the files that are present and the number of distinct computers as input, pad the array with 0's accordingly and calculate the percentile. I'll run some tests... ... View more

If you want to calculate the 95th percentile of the time taken for each URL where time_taken>10000 and then display a table with the URL, average time taken, count and 95th percentile you can use the following: sourcetype=W3SVC_Log s_computername="PRD" cs_uri_stem="/LMS/" time_taken>10000 | eventstats perc95(time_taken) as Perc95 by cs_uri_stem | stats avg(time_taken) as AvgTimetakenMS count(cs_uri_stem) as Count by cs_uri_stem,Perc95 | sort -Count | head 20 | eval AvgTimetakenMS = round(AvgTimetakenMS,0) | table cs_uri_stem,AvgTimetakenMS,Count,Perc95 Again, if that's the intended result... you may need to clarify 95th percentile of what. ... View more

Not that pretty but it works: index="test" | stats count by file | sort -count | map search="search index=test file!=$file$ | eval file=\"$file$\" | eval SizeMB=0 | append [search index=test file=$file$ | stats count by file,Machine,SizeMB]" | table file,SizeMB,Machine | stats p50(SizeMB) BY file Replace "test" with the name of your index. Notice that my "file" is lowercase. ... View more

What is the expected output for the two file types? ... View more

As jkat54 mentioned, the Splunk Add-on for Juniper is required in order to create the Splunk parsers for Juniper logs. In addition to that, make sure that you run the setup for the Firegen for Juniper app (it should launch automatically when you use it first time). During the setup you have to specify or confirm the index used to collect the Juniper logs. For example, if you collect your logs through an index called "ssg", the setup page should look like this: This setting configures the ssg_index macro used by the analyzer app. If the app still doesn't show any stats after you configure the index, make sure that indeed you do have log entries for the time interval that you are trying to analyze. Open a regular search box and just enter the index and the time interval. The search should return the Juniper entries. Confirm that the entries contain fields such as src, dst, action, service, dst_port, sent and rcvd: If the fields are not present then it's possible that the Splunk Add-on for Juniper is not installed properly or the log entries are not in the format expected by the add-on. Post a screenshot with the extracted fields if that's the case so we can take a look. ... View more

It seems inevitable that a local process/script would have to convert the binary logs to a text format. I'm assuming that a Splunk forwarder is installed on the Windows servers? The forwarder is simply reading the .log files like any other text files. How about using a scripted input? Here are some links: Scripted Inputs Overview PowerShell scripted input ... View more

Did you try collecting the remote events through WMI? There are some caveats on using WMI but for the odd server it may be viable. ... View more

You can specify the search command and then pipe it to the csv output. Example: index=syslog | head 10 | outputcsv rawsyslog.csv This will save the first 10 records in the syslog index to the rawsyslog.csv file (CSV format) in $SPLUNK_HOME/var/run/splunk. You can also run the splunk search from command line and export the data. This is probably the best option. For example, the command below will retrieve the first 10 records from the syslog index and save it to a file called rawsyslog.txt. You will have to adjust your search command accordingly. C:\Program Files\Splunk\bin>splunk search "index=syslog | head 10" -preview 0 -maxout 0 -output rawdata > rawsyslog.txt ... View more