I need assistance building a search that looks back in time 5 minutes to check and see if fields are present.  If so I do not need it to return any results.  This is correlating two different security logs Example: sourcetype=a field=1 field=2 field=3 is used to look back 5 minutes against  sourcetype=b field=1 field=2 field=3 If there is a match, return no results.  If no match, return sourcetype=a field=1 field=2 field=3 results. Any assistance would be appreciated. ... View more

I am trying not to reinvent the wheel. There is a requirement where WinEventLogs are indexed as csv files. The sourcetype is automatically detected as structured data and set to csv. I have tried to look through the Splunk_TA_Windows to see if there were any field extraction config that I could modify slightly to get the field extractions to work. So far I have been unsuccessful. The issue is that the normal message of the log is showing as EXTRA_FIELD_6. I could create a bunch of manual field extractions for Account Name, Account Domain, etc, but it would be great if I could leverage someone else's heavy lifting. Any thoughts would be appreciated. Thanks ... View more

I know that there are several threads on answers that reference alerts based on standard deviation. I have tried a few of them and the use cases do not seem to meet what I need. I would like to create an alert that will fire when the average of events over 5 minutes is greater than 2 standard deviations of the average of events over 60 minutes. This post is the closest I have found, but I am still stuck. https://answers.splunk.com/answers/227404/alert-when-sample-is-2-standard-deviations-from-mo.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev Any assistance would be appreciated. Thanks ... View more

I recently started ingesting a new windows event log as XML. It changed the format in Splunk web, but it isn't treating it as an XML file. We are ingesting other XML files and they are arranged in more of an XML view with expandable sections and coloring. The Windows XML logs are shown similar to the default view, line wrapped and no coloring. Is there a way to get Splunk web to display them as the other XML logs? ... View more

I am having an issue running a python script from my dev Splunk search head. I keep getting this message: ERROR:root:code for hash md5 was not found. I am running this on RHEL 6.7. I have checked and openssl is installed and up to date. Python2.6 is also pre-installed with RHEL6.7. However with I run the python script I am using Python2.7 which is installed with Splunk 6.3. Some diagnostic outputs are below. [johndr@HO-SPLUNKES ~]$ which python /opt/splunk/bin/python [johndr@HO-SPLUNKES ~]$ python Python 2.7.9 (default, Jul 15 2015, 01:30:03) [GCC 4.7.3] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> help("modules") Please wait a moment while I gather a list of all available modules... ERROR:root:code for hash md5 was not found. Traceback (most recent call last): File "/opt/splunk/lib/python2.7/hashlib.py", line 147, in <module> globals()[__func_name] = __get_hash(__func_name) File "/opt/splunk/lib/python2.7/hashlib.py", line 97, in __get_builtin_constru ctor raise ValueError('unsupported hash type ' + name) ValueError: unsupported hash type md5 ERROR:root:code for hash sha1 was not found. Traceback (most recent call last): File "/opt/splunk/lib/python2.7/hashlib.py", line 147, in <module> globals()[__func_name] = __get_hash(__func_name) File "/opt/splunk/lib/python2.7/hashlib.py", line 97, in __get_builtin_constru ctor raise ValueError('unsupported hash type ' + name) ValueError: unsupported hash type sha1 BaseHTTPServer bz2 io sets Bastion cPickle itertools sgmllib CDROM cProfile json sha CGIHTTPServer cStringIO keyword shelve ConfigParser calendar linecache shlex Cookie cgi locale shutil DLFCN cgitb logging signal DocXMLRPCServer cherrypy lxml site HTMLParser chunk macpath sitecustomize IN cmd macurl2path smtpd IPy code mailbox smtplib M2Crypto codecs mailcap sndhdr MimeWriter codeop mako socket OpenSSL collections markupbase splunk Queue colorsys marshal sre SimpleHTTPServer commands math sre_compile SimpleXMLRPCServer compileall md5 sre_constants SocketServer compiler mhlib sre_parse StringIO contextlib mimetools ssl TYPES cookielib mimetypes stat UserDict copy mimify statvfs UserList copy_reg modulefinder string UserString cssmin multifile stringold _LWPCookieJar csv multiprocessing stringprep _MozillaCookieJar datetime mutex strop __builtin__ dbhash netrc struct __future__ decimal new subprocess _abcoll decorator nntplib sunau _ast difflib ntpath sunaudio _bisect dircache nturl2path symbol _codecs dis numbers symtable _collections distutils opcode sys _csv django operator sysconfig _elementtree doctest optparse tabnanny _functools dumbdbm os tarfile _hashlib dummy_thread os2emxpath telnetlib _heapq dummy_threading parser tempfile _io email pdb termios _json encodings pickle textwrap _locale ensurepip pickletools this _multiprocessing errno pipes thread _osx_support exceptions pkg_resources threading _pyio fcntl pkgutil time _random filecmp platform timeit _sha256 fileinput plistlib toaiff _sha512 fnmatch png token _socket formatter popen2 tokenize _sre formencode poplib trace _ssl fpformat posix traceback _strptime fractions posixfile tty _struct ftplib posixpath types _symtable functools pprint unicodedata _sysconfigdata future_builtins profile unittest _threading_local gc pstats urllib _warnings genericpath pty urllib2 _weakref getopt pwd urlparse _weakrefset getpass py_compile user abc gettext pyclbr uu aifc glob pydoc uuid antigravity gzip pydoc_data warnings anydbm hashlib pyexpat wave argparse heapq quopri weakref array hmac random webbrowser ast hotshot re whichdb asynchat htmlentitydefs reportlab wsgiref asyncore htmllib repr xdrlib atexit httplib requests xml audiodev httplib2 resource xmllib babel ihooks rexec xmlrpclib base64 imaplib rfc822 xxsubtype bdb imghdr rlcompleter zipfile beaker imp robotparser zipimport binascii importlib runpy zlib binhex imputil sched bisect inspect select Enter any module name to get more help. Or, type "modules spam" to search for modules whose descriptions contain the word "spam". >>> [johndr@HO-SPLUNKES lib-dynload]$ pwd /opt/splunk/lib/python2.7/lib-dynload [johndr@HO-SPLUNKES lib-dynload]$ ldd _hashlib.so linux-vdso.so.1 => (0x00007fff5cfa9000) libssl.so.1.0.0 => not found libcrypto.so.1.0.0 => not found libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f80556f1000) libc.so.6 => /lib64/libc.so.6 (0x00007f805535d000) /lib64/ld-linux-x86-64.so.2 (0x00000038e2a00000) [johndr@HO-SPLUNKES lib-dynload]$ sudo which python [sudo] password for johndr: /usr/bin/python [johndr@HO-SPLUNKES lib-dynload]$ pwd /usr/lib64/python2.6/lib-dynload [johndr@HO-SPLUNKES lib-dynload]$ ldd _hashlib.so linux-vdso.so.1 => (0x00007ffcd2c8f000) libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007f3b3bd82000) libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007f3b3b99e000) libpython2.6.so.1.0 => /usr/lib64/libpython2.6.so.1.0 (0x00007f3b3b5f7000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f3b3b3da000) libc.so.6 => /lib64/libc.so.6 (0x00007f3b3b046000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007f3b3ae01000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007f3b3ab1a000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007f3b3a916000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007f3b3a6e9000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f3b3a4e5000) libz.so.1 => /lib64/libz.so.1 (0x00007f3b3a2cf000) libutil.so.1 => /lib64/libutil.so.1 (0x00007f3b3a0cb000) libm.so.6 => /lib64/libm.so.6 (0x00007f3b39e47000) /lib64/ld-linux-x86-64.so.2 (0x00000038e2a00000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007f3b39c3c000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007f3b39a38000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f3b3981e000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f3b395fe000) I am stumped. Any assistance would be greatly appreciated. Thanks! ... View more

Is it possible to rsync an indexer's colddb which resides on an NFS export from that network location to another network location while the indexer is still running the Splunk service? A different machine will be performing the rsync. I was planning on initiating rsync for the first pass while the indexer was still running. Once the rsync job was complete, stop the indexer Splunk service, then run one more rsync for incremental changes. After that point the indexer to the new colddb and start Splunk service on the indexer. Anyone know if this is a viable option for migration of the colddb? Thanks in advance ... View more

I am currently experimenting monitoring Office365 IP/URL changes (https://support.content.office.net/en-us/static/O365IPAddresses.xml) with the REST API modular input. I am able to poll and index the O365 data as well as run spath against it. However, every line of XML is being line broken into individual events. I am not able to search on a parent grouping in the XML to output all values in that grouping. Below is an example. I am not able to search for product{@name}=o365 and it return all address contained. <product name="o365"> <addresslist type="IPv6"> <address>2603:1030:800:5::bfee:a0ad</address> <address>2620:1ec:34::/48</address> <address>2620:1ec:38d::/48</address> <address>2620:1ec:4::/48</address> <address>2620:1ec:5::/48</address> <address>2620:1ec:6::/48</address> <address>2620:1ec:7::/48</address> <address>2620:1ec:a::/48</address> <address>2620:1ec:a92::/48</address> <address>2620:1ec:b::/48</address> <address>2620:1ec:c11::/48</address> <address>2801:80:1d0:1c00::/64</address> <address>2a01:111:2003::/48</address> <address>2a01:111:200a:a::/64</address> <address>2a01:111:202c::/48</address> <address>2a01:111:202e::/48</address> <address>2a01:111:202d::/48</address> <address>2a01:111:2035:8::/64</address> <address>2a01:111:f100:1004::4134:f0c8</address> <address>2a01:111:f100:7000::6fdd:682b</address> <address>2a01:111:f100:8001::d5c7:8077</address> <address>2a01:111:f102:8001::1761:4237</address> <address>2a01:111:f100:a001::a83f:5c85</address> <address>2a01:111:f406:1::/64</address> <address>2a01:111:f406:1000::/64</address> <address>2a01:111:f406:1004::/64</address> <address>2a01:111:f406:1801::/64</address> <address>2a01:111:f406:1805::/64</address> <address>2a01:111:f406:3404::/64</address> <address>2A01:111:F406:8000::/64</address> <address>2a01:111:f406:8801::/64</address> <address>2a01:111:f406:a003::/64</address> <address>2a01:111:f406:c00::/64</address> <address>2001:489a:2101:100::/64</address> </addresslist> What I would like to do is monitor for any changes to the list and output an alert showing what has changed. Future state might be to modify devices on-prem via their respective API with Splunk based on this list changing. I am also open to ideas on how to accomplish this in another way. Any input would be appreciated. Thanks ... View more