Damien is right. I've done similar implementation, but the Switching is in AS/400 instead of BAS24, however the solution would be the same. These are the steps I did: 1. Tap the network, using TAP or SPAN of your choice, since Switching won't allow us to install any agent in their server. 2. Do the PCAP, parsing, and masking IN MEMORY. Since it is audited as CDE in PCI-DSS compliance. 3. Send the parsed and masked data to Splunk Forwarder. done! Step number 2 is important, since some fields in BASE24 contains Sensitive Authentication Data such as Encrypted PIN and Full Track 2 Data, it will break the compliant if we store the PCAP in indexer. However, with proper treatment, I can even exclude the Indexer and Search Head from CDE in PCI-DSS compliance. Only the Forwarder and TAP are audited as CDE. ... View more

To extract "LoadABCDEF" from /Folder1/Folder2/Folder3/Folder4/Folder5/LoadABCDEF_20160921.log: | rex field=source "(\/\w+){5}\/(?<rexOutput>[A-Za-z0-9]+).*" | table rexOutput To extract "Folder3": | rex field=source "(\/\w+){2}\/(?<rexOutput>[^\/]+).*" | table rexOutput It wil work regardless how many symbol you put in folder3 you can test with "F-old(er)_3$%" ... View more

try this: | rex field=source "(\/\w+){3}\/(?<rexOutput>\w+)\S+" | table rexOutput ... View more

Oh, it seems that you need to convert your _raw to upper case like this: index=main sourcetype=sampledata "TRL*" OR "Header*" | EVAL mytype=CASE(MATCH(upper(_raw),"TRL"), "TRAILER",MATCH( upper(_raw),"HEADER"), "HEADER") | stats count by source, mytype, _raw | WHERE count>1 | CHART first(_raw) by source, mytype You should be able to see the duplicated _raw in header and trailer for each source ... View more

after the question mark "?", you need to add the or <output> field I don't know why I can't type those "angle bracket" in the answer like <> or <> ... View more

To extract /Folder1/Folder2/Folder3/Folder4/Folder5/LoadABCDEF_20160921.log Try this: | rex field=source "(?[A-Za-z]+_[0-9]+).log" it will only extract the last filename as long as it is written in "alphabet_numeric.log" format To extract /Folder1/Folder2/Folder3/OrderOnline_ABCD/Folder4/ path try this: | rex field=source "(?[A-Za-z]+_[A-Za-z]+)" it will extract only the folder with "alphabet_alphabet" format ... View more

Try this: index=main sourcetype=sampledata "TRL*" OR "Header*" | EVAL mytype=CASE(MATCH(_raw,"TRL"), "TRAILER",MATCH( _raw,"Header"), "HEADER") | chart count by source, mytype | SEARCH TRAILER>1 AND HEADER>1 It should show you every source with duplicated "TRL" and "Header" ... View more

I don't know Kibana. But, I know you can show a histogram in Splunk, you can append this on your query: | TIMECHART count by host And then go to "Visualization" tab, Choose "Column" chart, Click "Format", Choose "Stacked", and "Apply" You can change "by host" to anything you want, or you can remove it if you don't need to categorize the histogram. If this is not what you want, maybe you can help me by posting your query in Splunk, and screenshot of your expected dashboard visualization in Kibana. ... View more

It's a typo, he was mentioning this: | tstats count values(sourcetype) where index=* OR index=_* Just FYI, if your free space falls below 5GB, Splunk will stop indexing by default. If this is the case, you might need to delete some temp files from your OS. Or you can adjust this limit by going to : Settings -> System Settings -> General Settings -> Pause indexing if free disk space (in MB) falls below * ... View more

Have you set your search time range to "All Time" ? If it doesn't work, then go to Settings -> Indexes -> click on your index 1. Check your index How big is "Current Size" and "Max Size"? 2. How many "Event Count" are shown? You might need to add more space if your index is running out of space ... View more

Is this what you mean? index=notable | TABLE host rule_title creator owner status ... View more

If you are using Windows, there is a workaround (not real solution, but it should solve your problem) From your start menu type and search for "ODBC Data Sources" Create a System DSN Add "Excel Files" data source Choose your CSV file Now the CSV file becomes accessible via ODBC Driver, voila! Use Splunk DBLookup to fetch data from the DSN ... View more

You should append "| stats dc()" to your search query, and remove users with single device. Try to append this query to your search: | stats dc(host) as unique_device_count, last(host) as current_device by Account_Name | SEARCH unique_device_count > 1 | TABLE Account_Name, unique_device_count, current_device ... View more

You'll need to write a script to read and extract your TLV into comma separated T=V Example, if you are using 3 digits decimal TLV, your script should have input/output as follow: Input: 001005Hello999006World! Output: T001=Hello, T999=World! If your script works, you can use Splunk scripted input https://docs.splunk.com/Documentation/Splunk/6.4.3/AdvancedDev/ScriptSetup ... View more

Thanks for your answer! Btw, is there any roadmap to measure the handshake time? We are facing firewall performance issue here, that sometimes it takes around 1000 milliseconds just to create a new tcp connection. The problem is we need to show evidence how often does it occur, how long, and when precisely? ... View more

Question> Splunk for general purpose free text searches or structural searches? Splunk works best with time series data, while your use case might be more similar to master data management that changes often with update operation. However you can all rows from DB everyday to Splunk using DB Connect Input Type = Batch if you want to, if it doesn't break your daily ingestion limit. With this, you will get all your data into Splunk, updated everyday. Question> Can Splunk be used as an event stream for that? (event sourcing) For the event sourcing you've mentioned, try STREAMSTATS command, the result will change as you change the time range of your search ... View more