Hi Community, We are trying to integrate cisco ucs central manager with splunk. We did configurations at splunk end by going through installation and configuration guide however no data in splunk and ta_cisco_ucs logs have the following error : "Failed to parse XML response Invalid URL, please make sure the URL is correct". Below are the few details for your reference: TA Version 3.0.0, we have configured #server_url = ucs central manager host, service account created to authenticate ucs central manager(Login to ucs central manager using svc account was successful) and we have set #disable_ssl_verification = true in cisco_ucs_servers.conf but no luck. Any suggestions are appreciated. Thank you. ... View more

Hello Community, We have a scheduled weekly report that used to take 30 mins, now takes more than 20 hrs to complete and when we inspected search job we could see few search components taking more duration. Is there any way out to identify what might be the root cause or what might have caused this search to run for loner duration? Any suggestions are appreciated! The search has completed and has returned 3,664 results by scanning 438,673,166,793 events in 73,635.129 seconds~20.4542025 hrs Duration (seconds) Component Invocations Input count Output count 205,560.16 command.search 4,020,759 7,580,746,540 9,809,797,326 256,005.83 command.tstats 2,990,397 39,155,807 39,159,471 255,889.30 dispatch.stream.remote 1,495,082 ----- 12,281,759,678 Following are the completion times Nov 4th - 35 mins Nov 11th - 35 mins Nov 18th - 30 mins Nov 25th - 35 mins Dec 2nd - 29 mins Dec 9th - 32 mins Dec 16th - 34 mins Dec 23rd - 36 mins Dec 30th - 35 mins Jan 6th - 35 mins Jan 13th - 7h 5m Jan 30th - 12h 58m Jan 27th - 18h 35m Feb 3rd - 35hr 45m ... View more

Hi Splunkers, I am trying to ingest os_metrics logs from one of our prod server to splunk. In QA and dev instance, events are breaking correctly. I pushed the same configs(see below) to production server however i see distorted events when searching the data in prod SH for e.g Thu 10/10/2019 0:43:56.32 Checking "ABC" as one event and ping results as another event. Similarly Thu 10/10/2019 0:44:18.12 Get MAC Address for "PQR" as one event and physical address details as another event(below is the sample data) Splunk is reading old data files from production server and i am able to see old data breaking into events correctly but when new data started to ingest, i see them all getting distorted So, Do i have to place props in our SH cluster or is it something to do with props? Can someone please help me to resolve this issue? Thanks in advance. Sample data: Thu 10/10/2019 0:43:56.32 Checking "ABC" Pinging ABC [ip] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 0.0.0.0: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), Thu 10/10/2019 0:44:18.12 Get MAC Address for "PQR" Physical Address Transport Name =================== ========================================================== \Device\Tcpip_{} N/A Media disconnected N/A Media disconnected N/A Media disconnected props.conf [xyz] NO_BINARY_CHECK=true CHARSET=UTF-8 SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE = \w+\s+\d+\/\d+\/\d+\s+\d+:\d+:\d+ disabled=false inputs.conf [monitor://abc*.log] disabled = 0 index = xxxxx sourcetype = xyz ... View more

We have a use case query : Detect when auditing service on any critical system was disabled, stopped or restarted more than once in the past 7 days. search query: earliest=-7d@d index=X OR index=Y sourcetype=abc EventCode=1100 | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode | ctime(firstTime) | ctime(lastTime) | where count > 1 I am not able to get the user field because in windows event viewer there is no user info logged with 1100 event code(PFB link for more information) https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100.[link text]1 I had thought of using ComputerName as common field in the search query to fetch user details since multiple users will be logged in to the same host this approach is not feasible. So could anyone shed some light on how to get user field for this use case? ... View more

I was using the below search query to find the failed logins by domain admins however i was asked not to use lookup file cause client wanted the real time data. macro EventCode=4625 | stats count values(Workstation_Name) AS Workstation_Name, Values(Source_Network_Address) AS Source_IP_Address, values(host) AS Host by Account_Name | where count > 5 | search [| inputlookup xxxxxxx.csv | rex field=user "(?\w+)\W(?\w+)" | table Account_Name] So now i have two searches which i need to combine to get the real time data however i am unable to do so and not getting the correct results. Query 1 : To find failed logins for all users macro EventCode=4625 | stats count values(Workstation_Name) AS Workstation_Name, Values(Source_Network_Address) AS Source_IP_Address, values(host) AS Host by Account_Name | where count > 5 Query 2: To fetch all domain admin details (FYI: We are not using AD add-in our environment to read AD directly) index=xxxxxxxx | rex field=distinguishedName "DC=(?[\w]+)" | eval user_domain=upper(user_domain) | eval user=user_domain + "\" + sAMAccountName | eval user=upper(user) | eval lastLogonTimestamp=strptime(lastLogonTimestamp, "%Y-%m-%dT%H:%M:%s.%6N") | stats latest(lastLogonTimestamp) as lastlogon latest(timeCollected) as timecollected values(memberOf{}) as memberof by user | fields - lastlogon timecollected | search memberof IN ("CN=xxxx*", "CN=xxxx,CN=xxxx*") I need to now combine query1 and query2 searches to get real time data(i.e. failed logins by domain admins details in real time). So, could anyone help me in merging these two queries. Thanks in advance ... View more