| rex field=_raw "(?<dscvIP>[^\.]\d+\.\d+\.\d+\.\d+[\s|\:])" Using the above rex command to try to capture IP addresses, an it works most of the time, but I still get a few false positives for ESX log entries that contain the following Rcv-tx-10.20.30.45.78.80 The rex field captures 30.45.78.80 as the dscvIP field. I thought by adding the [^\.] to the beginning of the regex match it would not capture an string matching the IP syntax that had a period(.) immediately preceding the string. And I also thought this string would be skipped all together because for it to not start with a period(.) , the match would have to go to the dash(-) following tx, but then would not match because there is not a space or colon after the 4th \d+ match. What am  ... View more

We are trying to setup the universal forwarder on a Windows AD server. After configuring the index to receive on port 9997 and installing the UF on the server. The Forwarder does not appear under the Data Inputs/Windows Event Log of Forwarded inputs. I have verified the firewall is allowing packets on port 9997. I have verified using tcpdump that packets are being received on port 9997. I have checked the splunkd.log and found the error indicating TcpInputProc connection from Read Timeout Timed out after 600 seconds. Documentation indicated sslVersion possible issue - verified the sslVersion on both the inputs.conf of the indexer and the web.conf and outputs.conf of the UF. Documentation indicated the internal queue on the indexer may be blocked, which causes a timeout after 600 seconds. How do I find the inrernal queue and troubleshoot if it is blocked? Thanks in advance for any suggestions. J ... View more

Fairly new to Splunk and I am trying to understand the reason for the difference in results and search time for the following: Created an extracted field for a Windows log - WinTempFieldType When I run a search for: WinTempFieldType=Error Search takes seconds, less that a full minute and finds less than 100 results When I run a search for: WinTempFieldType=* | search WinTempFieldType=Error Search takes 15 minutes and finds 5,000+ results I ran across this, because I have a report that has a table that I based off the following search: WinTempFieldType=* | stats count WinTempFieldType | sort -count | table WinTempFieldType count When the report ran the table showed the WinTempFieldType row with Error and a count over 5,000 - but when I clicked on the error cell to drill down, the pending search only showed less than 100 results. So that is when I tried to manually replicate the issue and got the same results. Now I am just trying to understand WHY? ... View more

Thanks in advance for any assistance.. I am trying to create an alert that creates a table that shows sourceIP, country, LogMessageID, VPNuser and VPNgroup for attempted VPN connections. I get the sourceIP for successful session creations to the IP address of the VPN devices. host=<perimeterFW> session_state!="denied" destIP=<VPN device IP> | iplocation sourceIP | table sourceIP country That search works - I get a table showing all the sourceIPs and corresponding Countries. I have extracted some fields from the internal firewall logs, LogMessageID, VPNsourceIP, VPNuserID and VPNgroupID. Then I want to search the internal firewall logs to see if the sessions was successful (LogMessageID = 113039) or unsuccessful (LogMessageID = 302014). If I create a search: host=<internal firewall> (LogMessageID = 113039 OR LogMessageID=302014) | table LogMessageID VPNsourceIP VPNuserID VPNgroupID Again, I successfully produce a table with the LogMessageID, VPNsourceIP, VPNuserID, and VPNgroupID. Now I want to combine the two searches in an alert that triggers each time a VPN session is attempted: host=<perimeterFW> session_state!="denied" destIP=<VPN device IP> | iplocation sourceIP | (haven't found the correct command) [ host=<internal firewall> VPNsourceIP=sourceIP (LogMessageID = 113039 OR LogMessageID=302014) | return LogMessID=LogMessageID VPNuser=VPNuserID VPNgroup=VPNgroupID ] | table sourceIP Country LogMessID VPNuser VPNgroup Currently I get a table with the sourceIP and country, but the other 3 columns are blank. Thanks for your assistance. ... View more