About sonomauser

sonomauser · ‎11-08-2021

Thank you again. I definitely read both of those articles before posting and took their suggestions, it just wasn't showing the PST time in Search and I was having a hard time conceptualizing how it should work or what I was doing wrong. It's working now, so thank you.

sonomauser · ‎11-04-2021

Ok. Thank you. I wasn't intentionally trying to alter the actual timestamp in the logs, I just wasn't quite sure how Splunk handled this type of thing. I was able to get it to work by putting TZ in the source type stanza on the Indexer, not the HF. I thought this had to be done on the HF, but I suppose that was my misunderstanding.

sonomauser · ‎11-03-2021

I apologize since similar questions have been asked numerous times in the past. I have read several of them on this site as well as Splunk's own timezone article. I've tried a lot of things based on these articles, but the _time value doesn't appear to change at all. I'm either doing something wrong or my expectations are off. Background: We are PST. The Operating Systems for all our Splunk servers are configured for PST and are running Splunk 8.1.3. We are using a heavy forwarder to index IIS logs that are in UTC. When searching these logs in Splunk, I would like the canned times (Last 4 Hours, Last 60 Minutes, etc.) to reflect the PST-equivalent times they occurred. So if I'm searching for something that happened 30 minutes ago in real time, "Last 60 Minutes" will contain that log. It is my understanding that I am supposed to create/edit the props.conf on the heavy forwarder (/opt/splunk/etc/apps/iis/local/props.conf) and specify the TZ these logs files are set to: [sourcetype_name] TZ = UTC Then restart Splunk on the heavy forwarder. This is done and I've restarted the entire Splunk farm. I've even set this in the /opt/splunk/etc/system/local/props.conf on the HF. These logs are still being indexed 7 hours into the future. Should this be working or am I thinking about this completely wrong? If my thinking is off-base, is it possible to accomplish what I'm attempting? Any suggestions would be appreciated. Thank you.

sonomauser · ‎10-25-2021

Thank you for your assistance, PickleRick's suggested Regex was able to give me the results I was looking for. Poor regex usage on my part. However, to answer your questions, this is a Search Time extraction. Some sample data would be: 2021-10-20 00:00:11 POST /EWS/Exchange.asmx &CorrelationID=<empty>;&cafeReqId=a0d15c2a-4c65-bd1837e8755d; domain\username 192.168.111.222 Microsoft+Office/16.0+(Windows+NT+10.0;+Microsoft+Outlook+16.0.5149;+Pro) 200 and 2021-10-20 00:00:05 POST /Microsoft-Server-ActiveSync/default.eas Cmd=Ping&User=domain%5username&DeviceId=bc6fbaac6f14f7811cea8d7&DeviceType=Outlook&CorrelationID=<empty>;&cafeReqId=4a35be43-351a-662266fc3188; domain\username 111.222.333.444 Outlook-iOS-Android/1.0 - 200 What I meant by "contains data that isn't exactly correct" is that when using (?P<Test>domain\S+), the extraction would grab "username\domain" from the first example event, but would also grab "domain%5username&DeviceId=bc6fbaac6f14f7811cea8d7&DeviceType=Outlook&CorrelationID=<empty>;&cafeReqId=4a35be43-351a-662266fc3188" from the second example. Almost right, but way too much. Clearly a lack of regex understanding on my part. Thank you.

sonomauser · ‎10-25-2021

Thank you. I was using rex. Your suggested regex totally worked and now it's in the Interesting fields. Thank you very much. I wish I knew enough about regex to know what makes a decent extraction vs a less than decent. (?<userdomain>\S+)\\(?<username>\S+) I will mark this as the solution.

sonomauser · ‎10-22-2021

Hello Splunk Wizards, I know there are plenty of people who've had similar issues, but I haven't been able to use their resolution for my issue. I'm doing a search time field extraction to capture login username, which includes a backslash. I have the regex correct (?P<User_Name>(domain\\\\\\S+)) slightly modified from regex 101 for Splunk. In the field extraction wizard, it perfectly grabs all sample data (ex: domain\username). (?P<User_Name>(domain\\\\\\S+)) However, this field doesn't show up in search when looking at the exact same sample data. I've performed a verbose search and made sure all available fields are showing, it's not there. I've tried using groups names I know Splunk isn't already using, no improvement. Pretty sure it was to do with the backslash, because if I modify the regex to (?P<User_Name>domain\S+), the field extraction shows up in search, but it also contains data that isn't exactly correct. (?P<User_Name>domain\S+) I've tried variations with more and less backslashes, none seem to work. I guess I can live with a sloppy field extraction if that's all I can do, but the first regex really is perfect. Any ideas?

sonomauser · ‎05-01-2019

This was it! Thank you.

sonomauser · ‎04-08-2019

Hello, I'm running an eval Splunk Enterprise (7.2.5, Build 088f49762779) in our lab and configuring Splunk Add-On for Windows (6.0.0) according to Splunk docs. I have the indexer setup and am deploying Splunk_TA_windows successfully to my DC and collecting enabled stanzas. It's pretty vanilla stuff setup from what I've read in Splunk documentation. I'm playing around with custom indexes since everything is going to main as documented. I've created two custom indexes, "wineventlog" and "winad" in the indexes.conf located .\etc\system\local on the Splunk server. [wineventlog] homePath = $SPLUNK_DB/wineventlog/db coldPath = $SPLUNK_DB/wineventlog/colddb thawedPath = $SPLUNK_DB/wineventlog/thaweddb maxDataSize = 10000 maxHotBuckets = 10 [winad] homePath = $SPLUNK_DB/winad/db coldPath = $SPLUNK_DB/winad/colddb thawedPath = $SPLUNK_DB/winad/thaweddb maxDataSize = 10000 maxHotBuckets = 10 I have changed the inputs.conf file for this app to point to the new indexes, but only the wineventlog is being used, the AD monitoring is still going to the main index. I have confirmed the client has received the new Inputs conf file, but I'm obviously missing or don't understand something. Any ideas? [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" index = wineventlog renderXml=true [monitor://$WINDIR\debug\netlogon.log] sourcetype=MSAD:NT6:Netlogon index = winad disabled=0 [MonitorNoHandle://$WINDIR\System32\Dns\dns.log] sourcetype=MSAD:NT6:DNS index = winad disabled=0

Posts	8
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎04-08-2019

Online Status	Offline
Date Last Visited	‎05-28-2026 07:09 AM

Log files with different timezones (UTC)

Search time field extractions with backslash not s...

Custom index for Active Directory monitoring not b...

Re: Log files with different timezones (UTC)

Re: Log files with different timezones (UTC)

Log files with different timezones (UTC)

Re: Search time field extractions with backslash n...

Re: Search time field extractions with backslash n...

Search time field extractions with backslash not s...

Re: Why is the Splunk App for Windows Infrastructu...

Custom index for Active Directory monitoring not b...

Join the Conversation