Hi, I forgot my MSSQL encrypted db passwords that's written in Splunk DB Connect database.conf file and can't reset from MSSQL db since a lot of other business critical apps depends on it. Since it's encrypted in database.conf of Splunk DB Connect, I can't get it in cleartext. Is there any method to decrypt it? (using splunk.secret and Python console etc.) I'm using latest version of Splunk. Regards, Regards, ... View more

Hi, I've a universal forwarder on a Linux machine that forwards Security Onion logs to my Splunk instance. Logs are coming to network interface via port 9998 (checked tcpdump), When I try to search with; index=_internal metrics kb group=per_sourcetype_thruput | eval sizeMB = round(kb/1024,2)| stats sum(sizeMB) by series | sort -sum(sizeMB) | rename sum(sizeMB) AS "Size on Disk (MB)" It shows source names etc. and logs are coming to my instance but when I try to see the logs, I can't find the logs. They're being saved somewhere but I can't figure out the search to see them. How can i do this? Regards, ... View more

Hi, I've a periodic anomaly detection search (alert) query that results like this in inline mail result table; AVERAGE,PRESENT,THRESHOLDEXCEED 6836 ,15775 , YES (bold ones are field names) if there is no THRESHOLDEXCEED value, then alert doesn't trigger My query that calculates thresholdexeed value is like this; host="AVGMAILCOUNT" date_wday = [|stats count | eval A=strftime(now(),"%A") | return $A] | addinfo | eval saat=strftime(info_search_time,"%H") | eval dakka=strftime(info_search_time,"%M") | eval sonuc=if( date_hour == saat AND date_minute == dakka, "Evet","Hayır") | rename EXTRA_FIELD_3 as AVERAGE|search sonuc=Evet | stats values(*) as * | appendcols [search index=mailindex earliest=-10m | stats count as PRESENT] | where isnotnull(AVERAGE) AND isnotnull(PRESENT) | table AVERAGE, PRESENT| eval THRESHOLDEXCEED =if(PRESENT> AVERAGE*4, "YES","NO") If THRESHOLDEXCEED is YES, I also want to trigger a completely different query and append it to alert mail (as inline table) Query i want to include; index=mailindex earliest=-10m | stats count by subject | sort -count How can i achieve this? Thanks so much, Regards ... View more

Hi, I've a search query that returns 2 events with two different fields; EXTRA_FIELD_3 = XXXXXX GUNCELSAYI = YYYYYY I want to compare if EXTRA_FIELD_3 > GUNCELSAYI*2 and raise an alert. How can I do this? Regards, ... View more

Hi, I've a CSV imported data (hostname = AVGMAILCOUNT) and want to use its data based on present time values. What I'm trying to do is searching that data according to current time parameters but i get error; (Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.) I want search all data historially but for only same days (mondays for example) Query gives above error; host="AVGMAILCOUNT" date_wday = [ search eval A=strftime(now(),"%A") | return A] Regards, ... View more

I'm sending OSSEC logs via syslog. All OSSEC logs are indexed and can be found using search, but all OSSEC dashboards are empty. Why is that? ... View more

Hi, I'm trying to install Netscaler app for Splunk. My syslog log data is being pushed to a local file on the same machine with Splunk since there are 2 different NS machines. I want splunk to gather its data from this local file. While I'm defining Data Input from local file, there is no suitable source type for NS (ns_log). How can I solve this? When I try to define ns_log sourcetype by myself, it says there is already a ns_log sourcetype. Thanks ... View more