I have an alert to discover logins from accounts on servers and workstations. Some of these logins are normal and so I am attempting to create an exclusion for these events. This is a discovery process, and a list of normal logins is not known. At the moment, the exclusions are done with individual search commands for readability. But this query search lines are getting bigger by the day. <base-search> | search NOT (accountName=svcAPP01 AND computerName=srv-APP1-blah) | search NOT (accountName=svcAPP02 AND computerName=srv-APP02-*) | search NOT (accountName=svcAPP03 AND computerName=srv-APP03-blah computerName=ws-somename-blah) | table _time, accountName, computerName Is it possible to create an inputlookup table for such an exclusion, where the criteria are a combination of two fields; accountName and computerName? ... View more

I need some help with parsing Forcepoint CASB CEF logs in Splunk. The data does not seem to parse the epoch time stamps and all comes in as one event. I need to break these up into individual events and also parse the epoch time stamp in the format  "%Y-%m-%d %H:%M:%S" on ingestion into splunk.  SAMPLE DATA   CEF:0|Forcepoint CASB|Cloud Service Monitoring|1.0|63575192763|Activity|0|act=Monitor app= cat=Normal Activity cs1= destinationServiceName=Office365 deviceExternalId= deviceFacility=true deviceProcessName=loadBalancers dhost= dpriv=User dst=0.0.0.0 duser=14dd43c6-a792-4c07-a33b-c5e561a129de dvc=10.1.2.12 dvchost=somedomain end=1600408516000 externalId=0 fsize=-1 msg=//United States/Unknown outcome=Success proto= reason=modify request= requestClientApplication=Unknown/Unknown/"" rt=1600408516000 sourceServiceName=Unmanaged src=someIP start=1600408516000 suser= cs2= cs3= cs5=false cs6= dproc=Unknown flexString1=mc_rg-int-qa-eus02_aks-int01-qa-eus02_eastus2,kubernetes-internal cs4=14dd43c6-a792-4c07-a33b-c5e561a129de flexString2= AD.ThreatRadarCategory= AD.TORNetworks= AD.MaliciousIPs= AD.AnonymousProxies= AD.IPChain=someIP AD.IPOrigin=External AD.samAccountName=14dd43c6-a792-4c07-a33b-c5e561a129de CEF:0|Forcepoint CASB|Cloud Service Monitoring|1.0|63575216734|Activity|0|act=Monitor app= cat=Normal Activity cs1= destinationServiceName=Office365 deviceExternalId= deviceFacility=false deviceProcessName= dhost= dpriv=User dst=0.0.0.0 [email protected] dvc=10.1.2.12 dvchost=somedomain end=1600406172000 externalId=0 fsize=-1 msg=//United States/Unknown outcome=Success proto= reason=login request= requestClientApplication=Unknown/Unknown/"" rt=1600406172000 sourceServiceName=Unmanaged src=someIP start=1600406172000 suser= cs2= cs3= cs5=false cs6= dproc=Unknown flexString1= [email protected] flexString2= AD.ThreatRadarCategory= AD.TORNetworks= AD.MaliciousIPs= AD.AnonymousProxies= AD.IPChain=someIP AD.IPOrigin=Internal [email protected] CEF:0|Forcepoint CASB|Cloud Service Monitoring|1.0|63575216736|Activity|0|act=Monitor app= cat=Normal Activity cs1= destinationServiceName=Office365 deviceExternalId= deviceFacility=true deviceProcessName= dhost= dpriv=User dst=0.0.0.0 [email protected] dvc=10.1.2.12 dvchost=somedomain end=1600405713000 externalId=0 fsize=-1 msg=//United States/Unknown outcome=Success proto= reason=login request= requestClientApplication=Unknown/Unknown/"" rt=1600405713000 sourceServiceName=Unmanaged src=someIP start=1600405713000 suser= cs2= cs3= cs5=false cs6= dproc=Unknown flexString1= [email protected] flexString2= AD.ThreatRadarCategory= AD.TORNetworks= AD.MaliciousIPs= AD.AnonymousProxies= AD.IPChain=someIP AD.IPOrigin=External [email protected] CEF:0|Forcepoint CASB|Cloud Service Monitoring|1.0|63575216738|Activity|0|act=Monitor app= cat=Normal Activity cs1= destinationServiceName=Office365 deviceExternalId= deviceFacility=false deviceProcessName= dhost= dpriv=User dst=0.0.0.0 [email protected] dvc=10.1.2.12 dvchost=somedomain end=1600405674000 externalId=0 fsize=-1 msg=/1225/United States/Unknown outcome=Success proto= reason=login request= requestClientApplication=Unknown/Unknown/"" rt=1600405674000 sourceServiceName=Unmanaged src=someIP start=1600405674000 suser= cs2= cs3= cs5=false cs6= dproc=Unknown flexString1= cs4=someaccount flexString2= AD.ThreatRadarCategory= AD.TORNetworks= AD.MaliciousIPs= AD.AnonymousProxies= AD.IPChain=someIP AD.IPOrigin=Internal AD.samAccountName=someaccount CEF:0|Forcepoint CASB|Cloud Service Monitoring|1.0|63575216735|Activity|0|act=Monitor app= cat=Normal Activity cs1= destinationServiceName=Office365 deviceExternalId= deviceFacility=false deviceProcessName= dhost= dpriv=User dst=0.0.0.0 [email protected] dvc=10.1.2.12 dvchost=somedomain end=1600406165000 externalId=0 fsize=-1 msg=//United States/Unknown outcome=Success proto= reason=login request= requestClientApplication=Unknown/Unknown/"" rt=1600406165000 sourceServiceName=Unmanaged src=someIP start=1600406165000 suser= cs2= cs3= cs5=false cs6= dproc=Unknown flexString1= [email protected] flexString2= AD.ThreatRadarCategory= AD.TORNetworks= AD.MaliciousIPs= AD.AnonymousProxies= AD.IPChain=someIP AD.IPOrigin=Internal [email protected]     Assume that the sourcetype is called "cefevents" for this example.  PROPS.CONF   [cefevents] LINE_BREAKER = CEF:0.+[\r\n]? MAX_TIMESTAMP_LOOKAHEAD = 600 NO_BINARY_CHECK = true KV_MODE = none SHOULD_LINEMERGE = false TIME_FORMAT = %s%Q TIME_PREFIX = \s(start|end|rt)\=     The regex looks ok on regex101 https://regex101.com/r/hf7ZJs/1 but doesn't work on this data. I have also attempted using the props.conf from https://splunkbase.splunk.com/app/487/ but that does not help either. ... View more

I am attempting to index just a few interesting events from an application's log files. These are unstructured text files. I do not want to index the entire log files, as those are at least 400MB per file. The events that I want to extract may not even add up to 4MB per day. If I run a search with regex on the complete logs that were already indexed in a test run, I get just the required events. So this works.. index=someindex sourcetype=somesourcetype | regex _raw="my_regex_to_look_for_specific_text"   But when I add the same regex as a whitelist for future events, it does not index any new logs at all. If I take off the whitelist, the logs come in. [monitor://E:\Program Files\some app\Logs\...\servername_LOGTYPE_*.txt] disabled=0 index=someindex sourcetype=somesourcetype renderXml=false whitelist1 = _raw = "my_regex_to_look_for_specific_text"   The documentation seems to covers lot on whitelisting file names, and not content within the files. https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Whitelistorblacklistspecificincomingdata The only piece relevant to what I'm attempting to do is an example to blacklist the EventCode field with the value 4622. [WinEventLog:Security] blacklist1 = EventCode = "4662" Message = "Account Name:\s+(example account)"   The only difference I can see is that my logs are unstructured and do not have fields parsed by splunk. So that leaves me with _raw as a field for my whitelist. Is there a way to do the whitelisting of specific content in the _raw field? Or any other way? ... View more

I am attempting to calculate hours since an event occurred, however, the calculated time shows decimals including .6 to .9 between hour values. index=abc | eval time_difference=(now() - _time) | eval time_in_hours=(time_difference/60) | eval Hours_elapsed=round(time_in_hours/60,2) | eval Time=strftime(_time, "%Y-%m-%d %H:%M:%S") | table Time Hours_elapsed | sort - Hours_elapsed Here's an example of the output Time Hours_elapsed 2019-10-16 05:39:02 22.96 2019-10-16 05:39:19 22.96 2019-10-16 05:39:14 22.96 2019-10-16 05:48:48 22.80 2019-10-16 05:48:47 22.80 I've attempted to calculate the difference of now() and _time in epoch and then do an eval to calculate the hours, but have had no luck. ... View more