Hi there, I need help writing a query that finds the username of whoever ran a command on A Linux server. For example, if you look at the log below: <86>Mar 5 18:41:44 server1 useradd[2569]: new user: name=test1, UID=1100, GID=5020, home=/home/test1, shell=/bin/bash Someone with the session ID=2569 added a new user "test1". If I run another query like this: "pid=2569 eventtype=ssh_open", I can see to whom that session belongs. <86>Jan 24 18:34:03 test1 sshd[2569]: pam_unix(sshd:session): session opened for user admin by (uid=0) I was trying to write a query like this, but I keep hitting the wall : |multisearch [search index="linux_secure" eventtype=useradd | stats values(pid) AS pid1] [search index="linux_secure" eventtype=ssh_open | stats values(pid) AS pid2] | where pid1=pid2 The query above is not correct, and it returns errors like subsearch 1 contains a non-streaming command. I want to write something that checks for the identical pid and extracts the username from search2 and the action from search 1. Any help would be appreciated. Thanks, Arsalan ... View more

Hi everyone, I'm planning to create some indexes for compliance requirements to remove the old data. I wanted to start small and created this index, but I'm having a hard time understanding how it works. [test] homePath = /splunkdb/test/db coldPath = /splunkdb/test/colddb thawedPath =/splunkdb/test/thaweddb coldToFrozenDir =/splunkdb/test//frozen maxTotalDataSizeMB = 5000 maxHotBuckets = 3 (3 hours in Hot) maxHotSpanSecs = 3600 ( 1 hour) maxHotIdleSecs = 0 maxWarmDBCount = 3 3( Hours in Warm) frozenTimePeriodInSecs = 7200 ( 2 hours) from my understanding, I should I have 6 hours of data in Hot/Warm buckets. what I don't understand is how frozenTimePeriodInSecs works. it is now 10:40 and It has been almost 18 hours since I created that index. I created that index at 16:14. I have 7 buckets in my Frozen bucket. The oldest data is from 23:40. So I have almost 10 hours of searchable events. I Don't have anything in my Colddb. These file are in my db folder: -rw-------. 1 splunk splunk 10 Aug 7 16:14 CreationTime -rw-------. 1 splunk splunk 0 Aug 7 20:02 db_1565223179_1565219580_0.rbsentinel -rw-------. 1 splunk splunk 0 Aug 7 20:01 db_1565226054_1565223180_1.rbsentinel -rw-------. 1 splunk splunk 0 Aug 7 21:02 db_1565229653_1565226054_2.rbsentinel -rw-------. 1 splunk splunk 0 Aug 7 22:01 db_1565233253_1565229654_3.rbsentinel -rw-------. 1 splunk splunk 0 Aug 7 23:42 db_1565236853_1565233254_4.rbsentinel -rw-------. 1 splunk splunk 0 Aug 8 03:21 db_1565240453_1565236854_5.rbsentinel -rw-------. 1 splunk splunk 0 Aug 8 10:21 db_1565246453_1565240454_6.rbsentinel drwx--x---. 2 splunk splunk 6 Aug 7 16:14 GlobalMetaData drwx--x---. 3 splunk splunk 4096 Aug 8 11:24 hot_v1_7 drwx--x---. 3 splunk splunk 4096 Aug 8 11:24 hot_v1_8 drwx--x---. 3 splunk splunk 4096 Aug 8 11:25 hot_v1_9 These files are in my frozen folder: drwx--x---. 3 splunk splunk 21 Aug 7 20:02 db_1565223179_1565219580_0 drwx--x---. 3 splunk splunk 21 Aug 7 20:01 db_1565226054_1565223180_1 drwx--x---. 3 splunk splunk 21 Aug 7 21:02 db_1565229653_1565226054_2 drwx--x---. 3 splunk splunk 21 Aug 7 22:01 db_1565233253_1565229654_3 drwx--x---. 3 splunk splunk 21 Aug 7 23:42 db_1565236853_1565233254_4 drwx--x---. 3 splunk splunk 21 Aug 8 03:21 db_1565240453_1565236854_5 drwx--x---. 3 splunk splunk 21 Aug 8 10:21 db_1565246453_1565240454_6. I was thinking that after 6 hours ( 6 buckets), every hour the oldest bucket will get deleted. So after 18 hours, I was expecting to have 3 hours of data deleted. But I think I was wrong and I don't know how it works now. can anyone please help me understand how these FROZEN bucket rotation/rollover works? with my current settings how much searchable data I should be able to see? Best, Arsalan ... View more

Hi there, We are forwarding all of our /var/log/secure logs to a syslog server "syslogserver.local " and from there it's being forwarded to Splunk over a TCP port. The Splunk is configured as a single instance. in Data Inputs I created a TCP listener and the source type is linux_secure. In the search app most of the fields are getting extracted except the hostname "myhost " . The host field only shows the name of that syslog server instead of the name of the server that alert was generated. <85>Apr 25 15:22:03 myhost unix_chkpwd[20316]: password check failed for user (jon.doe) date_hour = 15 date_mday = 25 date_minute = 22 date_month = april date_second = 3 date_wday = thursday date_year = 2019 date_zone = local eventtype = err0r error eventtype = nix_errors error eventtype = nix_security os unix host = syslogserver local index = linux_index linecount = 1 pid = 20316 process = unix_chkpwd source = tcp:40515 sourcetype = linux_secure splunk_server = splunk.local src = syslogserver.local tag = error tag = os tag = unix timeendpos = 20 timestartpos = 4 As you can see, the value of the host and src are the same. syslogserver.local is the server that aggregates all the syslogs. and there is no field that shows "myhost" Any ideas of where the problem might be? ... View more