Hi @adamsmith47, to send some logs to two indexers groups you have to follow the instructios at https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input Ciao. Giuseppe ... View more

Yes, Splunk Stream can be deployed on a single instance in a Windows environment. However, as you mentioned, there are some limitations to this deployment method. One limitation is that you will not be able to use the Splunk Stream Universal Forwarder (UF) in a Windows environment. The UF is a Linux-only application that is used to collect data from Windows servers and send it to Splunk Stream. If you are deploying Splunk Stream on a single instance in a Windows environment, you will need to use the Splunk Stream Forwarder instead. The Splunk Stream Forwarder is a Windows-based application that can be used to collect data from Windows servers and send it to Splunk Stream. Another limitation to deploying Splunk Stream on a single instance in a Windows environment is that you will not be able to take advantage of the Splunk Stream clustering feature. Clustering allows you to scale Splunk Stream by distributing the load across multiple Splunk Stream servers. If you are deploying Splunk Stream on a single instance in a Windows environment, you will not be able to take advantage of this feature. Despite these limitations, deploying Splunk Stream on a single instance in a Windows environment can be a viable option for small deployments. If you are only collecting data from a few Windows servers, then the Splunk Stream Forwarder may be sufficient for your needs. Additionally, if you do not need to scale Splunk Stream, then you may not need to use the clustering feature. Ultimately, the decision of whether or not to deploy Splunk Stream on a single instance in a Windows environment depends on your specific needs. If you are unsure of whether or not this deployment method is right for you, then I recommend that you contact Splunk support for assistance.       ... View more

Ok, let's analyze what you want to get from your search. You have three different types of login_event and you want to count occurrences of each of them as well as distinct values of username field associated with each of those types of events. So the first part is what kind of summary you want to get <your search> | stats count dc(username) You want count of events as well as count of distinct values of username field. Now you need to tell splunk how to split the values. You want separate stats for each value of the login_event field. So you add by login_event And you're pretty much home - you should get all the information you need. If you don't like the layout (you should get 3x2 table) you can try to use untable. But that's another story. ... View more

Making it work without the macro first is a good idea. After that, keep in mind that a non-eval macro is a simple text substitution.  That means the value of the macro has to make syntactic sense when it replaces the macro invocation. Consider making the scope of the macro a little larger  It may work better as a complete command (perhaps with arguments) than as an argument to another command. ... View more

does this finally work? i have a similar query to trigger the sendemail inside the map command, but I got "2021-04-30 04:05:59,276 +0000 ERROR sendemail:1428 - [HTTP 403] Client is not authorized to perform requested action" error in index=_internal source=*python.log*, but the sendemail works if I run separately, some post said the script inside map missed the context, do you know how we could fix this?  ... View more

@adamsmith47  if you don't want to do the mvexpand, then do the comparison before you do the aggregation or, if you are using Splunk 8, you can use mvmap, see the last two lines of this example | makeresults | eval n=mvrange(1,4) | mvexpand n | eval _time = now() - (n * 1000) | eval mv_epoch = mvrange(1,6) | mvexpand mv_epoch | eval mv_epoch = _time - (random() % 4 + 29) * 86400 | eval days=(_time-mv_epoch)/86400 | eval t=strftime(mv_epoch, "%F %T") | stats values(mv_epoch) AS mv_epoch values(t) as t values(days) as days BY _time | eval e=relative_time(_time, "-30d@d") | eval test=if(isnull(mvmap(mv_epoch, if(e<=mv_epoch AND mv_epoch<=_time, 1, null()))),"no", "yes") ... View more

Found a way to spot the troublesome csv.  (worked for me, anyway)  requires CLI. The grep looks for special characters in the file. find $SPLUNK_HOME/etc -name "transforms.conf" | xargs grep -l -P -n "[\x80-\xFF]" find $SPLUNK_HOME/etc -name "*.csv" | xargs grep -l -P -n "[\x80-\xFF]"   Another thing that helped track down the issue was run the rest call as a Splunk search, then look at the search.log | rest /services/data/transforms/lookups ... View more

Hi, enable the invocation headers via GPO or windows registers and the PS will add the timestamps as they show in your post. Google it, or use this article https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html ... View more

Just wondering if you ever worked out the best solution for this? I have the exact same requirement ... View more

Ill add to this that you need to make sure you have the correct configurations deployed on your SH for indexed fields for them to be properly recognized via *fields.conf ( https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Configureindex-timefieldextraction) ... View more

Just re-reading my post, and to clarify what I have in mind, I'm looking for probably a | rest command and logic to determine whether the search was run by the scheduler, or if it were run manually. Thanks again. ... View more

I believe that if you deploy limits.conf to MyApp/[default|local]/ the limits will only apply to users of MyApp unless you have something like export=system in your .meta files. If you put limits.conf in etc/system/local they're global. Most all of the .conf files i can think of work this way. ... View more

You could replace the first timechart with an eventstats or simply leave it the way you got it if its fast. Please upvote/accept if this helped ... View more

Just shooting from the hip here, but we are talking about Windows. If there is a process actively writing to a file on Windows, it may have a read error due to the nature of how Windows can completely lock a file. Is this happening consistently on that file? I don't know if this would then prevent continued processing of the file, but it could be something to look into. ... View more

How many users do you typically have flagged at one time? How do you go about flagging them in Splunk (just adding to a lookup table maybe)? I haven't worked with ES, but could imagine building something around this with a couple lookups (csv or kvstore) and a scheduled search. One lookup one contain flagged users (update manually or with lookup editor or some other automation), and your scheduled search would constantly scan the last minute, every minute for auth events that match users in that lookup. The search would then input the auth events lookup, find new data in the last minute for matching users, remove users that don't exist anymore, and re-write the lookup. If you're going the ES route, a data model acceleration allows you to use tstats as a fast command to return results. I would assume if you dig into the macros for what's populating your dashboards, you'll find the searches they use behind the scenes. ... View more

I've attempted to provide an exhaustive answer to this at What is the best practice to address the "..is neither in the bundle downloaded from master nor managed by local deployment client..." validation failure? ... View more

Reposting my last post, 'cause some characters disappeared... No. It was a collection of app folders which any installation could start with, customize, then distribute to the appropriate instances. Examples: ORG_search_base would be deployed to all search heads, to config things like search peers. ORG_auth_base would be deployed to all instances to config things like LDAP settings. I'm looking for this collection of apps, before they're customized. They have names like ORG_search_base, ORG_cluster_master_base,ORG_multisite_base, etc... with ORG replaced with your own organization label. I can reach out to my PS guy if I have to. I just figured these packages were available somewhere. Thanks. ... View more

@adamsmith47 @roryab, refer to my answer : https://answers.splunk.com/answers/694309/how-do-you-create-the-below-chart-in-splunk.html#answer-696835 to create multiple sections in table data bar based on percent. The example display the value by default but shows actual percent of each segment as Tooltip text. ... View more

all good 🙂 i submitted a comment and not an answer. if it helped, you can up vote my comment glad you figured it out ... View more

Hello adamsmith47, You will want to setup an Accelerated Report. This will help to reduce the amount of time that it takes for this type of search to complete. The following is a link to the Documentation for setting up Accelerated Reports: http://docs.splunk.com/Documentation/Splunk/latest/Report/Acceleratereports ... View more

Would it be possible to assign a different sourcetype to events matching MyRegexA and MyRegexB? Example: Let: SourcetypeA = the incoming sourcetype SourcetypeB = the new sourcetype that we do not want to discard props.conf [sourcetypeA] TRANSFORMS-checkAB=checkAB, discardB transforms.conf [checkAB] REGEX = YOUR_A_AND_B_REGEX DEST_KEY = MetaData:Sourcetype FORMAT = SourcetypeB [discardB] REGEX = YOUR_B_REGEX DEST_KEY = queue FORMAT=nullQueue ... View more

The _time for the timestamp is fine. All search-time and index-time field extractions are working 100% as intended. However, I'd like to modify something. Several of the fields being extracted at search are fields which report data-specific information containing time. In a snipit of an event below, you will see "firstSeen", "lastSeen", "pluginModDate", and "pluginPubDate", all of which are epoch times, in the data. Is it possible to convert these times to human readable using props/transforms? ... exploitFrameworks: family: { [+] } firstSeen: 1486540578 hasBeenMitigated: 0 ip: ###.###.###.### lastSeen: 1486765040 macAddress: ##.##.##.##.##.## netbiosName: **domain\hostname** patchPubDate: 1485363600 pluginID: 96828 pluginInfo: 96828 (445/6) Google Chrome < 56.0.2924.76 Multiple Vulnerabilities pluginModDate: 1486400400 pluginName: Google Chrome < 56.0.2924.76 Multiple Vulnerabilities pluginPubDate: 1485536400 pluginText: ... Thanks again. ... View more