Hey Splunkers! I have some XML log files that I'm monitoring on a Windows 2003 server. I got my line/event breaking set up and that's all good. However, I'm getting separate events with the XML header and the master tag that defines the beginning of the file. <?xml version="1.0" encoding="utf-8" ?> <log> I also have events with just in them. I want to send these events to nullQueue but I'm not sure of the exact RegEx syntax I should use. Here is my config: **PROPS.CONF** [suckylogs:xml] TRANSFORMS-nullXmlHeader = chuckXmlHeader **TRANSFORMS.CONF** [chuckXmlHeader] REGEX = (?m)^(<\?xml)|(<log>)|(</log>) DEST_KEY = queue FORMAT = nullQueue I'm not sure if I should have 3 separate capture groups like I have here or one big one. Any assistance is appreciated! Thanks! ... View more

Hey folks! I'm attempting to get Sourcefire/FireSIGHT data with the Cisco eStreamer for Splunk app and I'm having trouble deciding where to put the app. It seems if I put it on both indexers in a cluster, then all logs will be gathered and indexed twice, which is not what I want. However, I want to maintain redundancy in case one of the indexers goes down. It seems there is no way to account for this. Do I really have to put it on only one indexer (or heavy forwarder) and hope that box doesn't go down? Any advice is appreciated. Also it seems this app hasn't been updated in a while, I hope it actually works on 6.4... ... View more

Hi Splunk Answers, I'm trying to do a lookup with a list of CVEs and the URL to them. The fields in the CSV file are QID, CVE-ID, and CVE-URL, which I'm outputting as cve_id and cve_url. I have events with a multi-valued field named 'qid'. I'd like to do a lookup on this field and output 2 new multi-valued fields, cve_id and cve_url. However, the lookup is just taking the first value for the 'qid' field and outputting the result from the CSV into cve_id and cve_url. Here is my lookup command: lookup qiddb_cve QID AS qid OUTPUTNEW "CVE-ID" AS cve_id "CVE-URL" AS cve_url I found a similar issue here but it doesn't seem that there's a working solution there. Has anyone found a way to generate a multi-valued output field from a lookup? I have to think someone's had this problem before, but I'm not finding a way to do it. Thanks!! ... View more

Hello Splunk Answers, Is there a way to retrieve the "AD FS 2.0" event chain from Windows Event Logs by using the standard WinEventLog stanza as found in the inputs.conf of the Splunk_TA_windows? The logs are not stored in the base "Application" events, so they don't come in even though we're monitoring the Application logs already. I want to try and do this without the Active Directory app if possible, but if that is the best way then please let me know. The servers in my environment running AD FS are not domain controllers - they are separate servers. I tried adding the following stanza to inputs.conf on one of the servers in my environment running AD FS 2.0: [WinEventLog://AD FS 2.0] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 I haven't seen any new ADFS logs come in from this server after bouncing the Universal Forwarder on it. The name of the log path in the Windows Event Viewer is "AD FS 2.0" with one log file within - "Admin". I also tried the same stanza as above, but with "WinEventLog://AD FS 2.0/Admin" and it still doesn't work. Am I missing something? I couldn't find anything online for people asking about getting AD FS into Splunk. Thank you!! ... View more