I am onboarding data from trend micro portable security via HEC. As per the documentation of trend micro it needs 5 indexes to be created at splunk end namely scanned log,detectedlog,assetinfo,updateinfo,application info . We have created these indexes on the HF and used the following transforms to send it to a single index in the indexers. The transforms used is [trendmicro_routing] REGEX = . DEST_KEY = _MetaData:Index FORMAT = app_trendmicro also we have created different sourcetypes for each of the 5 categories of logs (scanned log,detectedlog,assetinfo,updateinfo,application info ). The transforms stanzas used are [tmps_scannedlogs] REGEX = scannedFiles\= FORMAT = sourcetype::tmps_scannedlogs DEST_KEY = MetaData:Sourcetype [tmps_detectedlogs] REGEX = threatType\= FORMAT = sourcetype::tmps_detectedlogs DEST_KEY = MetaData:Sourcetype [tmps_assetinfo] REGEX = physicalMemory\= FORMAT = sourcetype::tmps_assetinfo DEST_KEY = MetaData:Sourcetype [tmps_applicationinfo] REGEX = installPath\= FORMAT = sourcetype::tmps_applicationinfo DEST_KEY = MetaData:Sourcetype [tmps_updateinfo] REGEX = ^(?!.*(scannedFiles|threatType|physicalMemory|installPath)).* FORMAT = sourcetype::tmps_updateinfo DEST_KEY = MetaData:Sourcetype Now the scanned and detected logs have a different time format which is like -> startTime=Jun 13 2022 14:29:4 Asset info logs have a different  time format like -> systemDateAndTime=16062022 12:47:26 and rest of the log types (updateinfo,applicatioinfo) does not have a timestamp. And what i understand is we can not apply timestamp settings after routing it to different sourcetypes. How to make splunk  parse different timeformat and apply proper settings??? ... View more

Hello Everyone, I am integrating logs from trend micro portable security  via HEC. As per the user guide of trend micro they need a HEC token that should have access to 5 indexes namely(sacnnedlog,detectedlog,applicationinfo,updateinfo,assetinfo) the names should not be changed as it will not be able to send logs . So I have created a HEC token with sourctype=trendmicro and have given access to all 5 indexes created on HF. Now the catch is in our splunk environment we cannot have 5 indexes for one source thus we have created 5 indexes at HF (same name as above) and we are trying to route all logs for sourcetype trendmicro to an index named app_trendmicro (created on Cluster master).  i have used following props and transforms In props:- [trendmicro] TRANSFORMS-routing = trendmicro_routing In transforms:- [trendmicro_routing] DEST_KEY = _MetaData:Index REGEX = . FORMAT = app_trendmicro however we are  not able to receive logs and getting error in internal index  as Received event for unconfigured/disabled/deleted index   ... View more

I need to understand how to integrate oracle netsuite logs with splunk. I tried searching but I am unable to find a proper method for this . Please help. ... View more

Hi All, I need to integrate trend micro portable security   ( which is an antivirus security program in a portable USB ) with splunk. However the addons available in splunk are for Trend micro deepsecurity or trend micro deep discovery. will trend micro deepsecurity addon work for trendmicro portable security logs ?? or is there any other way to integrate trend micro portable security logs with splunk? Detailed answer and  suitable links will be appreciated .. Thanks    ... View more

Hello Everyone, I have written props.conf in which i have added the below eval statement Eval-appname="newapp" and other Extract commands are also there. I have ingested the file and placed my app in an indexer for testing .I am unable to see the appname field on GUI but i am able to see the extracted fields extracted by EXTRACT command in the same props.conf. I have checked for app permissions and field permissions as well its set to "ALL Apps" Please help. in getting the calculated fields in GUI ... View more

i have a field as abc=1\,2\,3\,4\,5\, i need to reemove the backslashes and  have a multivalue field like abc=1,2,3,4,5 How to do this please help. ... View more

Hi All, I am working on dbconnect.(MYSQL Connection) I have a table in which there is column as below:- DATA DummyValue Host= dummyhost123 |User= dummyuser   I need to extract the values contained in the above column and add it to 3 columns Column1  : DummyValue Column2:  dummyhost123 Column 3: dummyuser Please Help. NOTE- I have tried using REGEXP_SUBSTR but it was showing error:-REGEXP_SUBSTR is not recognised as built in function name       ... View more

Hi all, I am very new to phantom. Its my first time dealing with it. I was trying to connect splunk instance to phantom. Following things worked fine:- 1. installed Splunk app for phantom 2. made server configurations with phantom. Now i made a saved search to send the data to phantom. Using the event forwarding-> new saved search. --> I selected my saved search , destination, enabled auto extracted fields and clicked on save. Now i am able to view events in splunk but i could not see any events in phantom. PLease help its very urgent... Thanks in advance!!! ... View more

We have one Real Time and one scheduled alert ,in both these alerts we have alert actions as mail . In the mail we send a link of " View results in Splunk". But we have found that these links get expired after 24 hours . How should we deal with this issue.? Kindly help!! ... View more

We have two scheduled alerts : 1) 1st fetch records for last 30 mins and cron expression :29,59 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 * * * 2) 2nd fetch records for last 6hrs and cron expression:59 5,11,17,23 * * * . . Here we have found 3 Alerts for 30 mins are skipped, which should be occurred at 10:59 PM, 11:29 PM , 11:59 PM and 1 Alert for 6 hrs skipped at 11:59 PM. Why these alerts are getting skipped.? Please help!!! ... View more

HI all, I am stuck in a scenario which has multiple conditions and i am unable to resolve it. Kindly Help!!! I have data as follows:- vin, cid, violationstatus, abc,45,45 def ,56,76 i want that if violationstatus<50 records 1-50 should be considered for dashboard generation if violationstatus>50 records 50-100 should be considered for dashboard generation HOw to do it please help.? ... View more