The Splunk Stream Add-on automatically extracts the query field. Run the following search in your dns index and verify that the "dns, network, and resolution" tags appear: index=<YOUR DNS INDEX> sourcetype="stream:dns" | stats count by tag If not, verify that you have the Splunk Stream Add-on installed: Navigate to Apps > Manage apps. The Splunk Stream Add-on is in the same packaged app as the Splunk Stream app but sometimes the add-on does not properly install. If you have the Add-on installed and the tags are showing up, verify that you have your DNS index whitelisted in the CIM setup. This can be done in Enterprise Security by Navigating to Configure > CIM Setup. Click the Network Resolution Data Model and verify the DNS index is whitelisted. ... View more

While in the Palo Alto app: Navigate to Settings > User Interface > Navigation menus Click on "default" to open up the Navigation menu XML. From there, you can add your custom view. The view name will be the name of the dashboard in the configuration file. You can verify the dashbord name by Navigating to Settings > User Interface > Views. Check out the following documentation for more information: https://dev.splunk.com/enterprise/docs/developapps/addnavsplunkapp/ Example Navigation XML <nav search_view="search"> <view name="search" default="true" /> <view name="datasets" /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> <view name="my_custom_palo_dashboard" /> </nav> ... View more

Yes, you can just download or manually update the file yourself. This will require a reboot. https://docs.splunk.com/Documentation/Splunk/6.6.3/ReleaseNotes/FixDatetimexml2020#Download_an_updated_version_of_datetime.xml_and_apply_it_to_each_of_your_Splunk_platform_instances ... View more

You can perform the evaluation before converting the variable to a string. For example: ... | eval pollingTime=strptime(requestDate,"%Y-%m-%d %H:%M:%S.%3N") | eval drainingTime=strptime(receivedDate,"%Y-%m-%d %H:%M:%S.%3N") | eval timeDiff=(drainingTime-pollingTime) | where timeDiff>3600 | eval timeDiff=tostring(timeDiff, "duration") | table requestDate receivedDate timeDiff If timeDiff is greater than 3600 seconds (1 hour), then only those events will show up. ... View more

From what it looks like, it seems you only care about the data between the <Record></Record> tags, correct? If this is the case, you could do something along these lines. The below configurations will trim the unwanted results using SED (regex may need to be altered if your data appears differently than the sample data previously provided). It includes a line breaker that breaks on the new record and also includes the date field which seems to be in the event. If this is not the correct date, you can simply set DATETIME_CONFIG = CURRENT or your desired value and remove the other time properties. I have set the kv mode to none as the fields are being extracted manually. props.conf [your:sourcetype] SEDCMD-0_remove_header = s/(<\?xml[^\>]+\>\s+\S+\s+\S+\s+\S+\s+\S+\s+\S+)//g SEDCMD-1_remove_footer = s/(\<\/DSIF\>)//g SHOULD_LINEMERGE = false LINE_BREAKER = ([\s\n\r]+)(<Record>) TIME_FORMAT = %Y%m%dT%H%M%S TIME_PREFIX = <Date> MAX_TIMESTAMP_LOOKAHEAD = 15 KV_MODE = none CHARSET = UTF-8 REPORT-0_fields = your_custom_fields transforms.conf [your_custom_fields] REGEX = \s+\<([^\>]+)\>([^\<\n\r]+)\<\/ FORMAT = $1::$2 This configuration will index the data as follows <Record> <Path>HFP/IAVAS</Path> <Size>14394144</Size> <Hash>438b87856704c7c3bb5b3927d6d5959aaf997e8777e1ede40d35ff425eb45116</Hash> <Date>20190825T195424</Date> <Name>windows10.0-kb4500641.exe</Name> </Record> <Record> <Path>ENG/ALL</Path> <Size>1458278573</Size> <Hash>b214cf5847fdd3244fae60036c6c9aad056e5114bd8320dd460cd902bd44a456</Hash> <Date>20190906T143311</Date> <Name>E2D_ALE_System_V091_Point_Release_20190822.zip</Name> </Record> <Record> <Path>HFP/Files</Path> <Size>569985537</Size> <Hash>dc51058df85791c0786e6f41eba315fd044f0fc911a70763748f3ec9ee95d272</Hash> <Date>20190919T013754</Date> <Name>1.02.02_version_update.zip</Name> </Record> Notice – the starting tags are not being indexed. Use this configuration only if that is your desired outcome ... View more

So this really depends on what type of logs you are ingesting into Splunk. If you have endpoint protection logs, such as crowdstrike or carbon black, you can use these to correlate processes being run on the machine. If sysmon is being utilized, these logs can also be very helpful. If the only logs you are ingesting from the device are standard windows logs, then this can be a bit tricky as Splunk is only aware of the data being sent to it (which in this case doesn't look to be processes running on the device). In that case, you may have to manually investigate the device. Autoruns64 from sysinternals is a handy tool to use as most malware will show on startup for persistence. ... View more

It is possible to get a breakdown of index, sourcetype, and source. However, for a certain EventCode can be tricky. First to get the usage for index, sourcetype, source, or even host, try the following: index=_internal sourcetype=splunkd component=metrics group=<group_to_filter> series=* where you can set the group field to be: 1. per_index_thruput 2. per_sourcetype_thruput 3. per_host_thruput 4. per_source_thruput and (optionally) you can choose a specific series. For example, if you use the group per_index_thruput the series would be the index i.e. series=windows . Full example: index=_internal sourcetype=splunkd component=metrics group=per_index_thruput series=windows earliest=-7d@d latest=@d | timechart span=1d sum(kb) as sum_kb by series For a specific EventCode, you could get a good estimation by seeing what percentage of your events are using that EventCode and correlate that to your metrics logs. i.e. index=windows | top 0 EventCode | search EventCode=302 note the percent column and cross reference to the previous metrics logs. This won't be exact, but it will give you a good idea. ... View more

I would recommend avoiding subsearches. They are really only good for certain circumstances and often negatively affect performance. Also, some special characters in field names can lead to issues during search time. It's recommended to change how these fields are being extracted using props and transforms. For simplicity try this: index=email (sourcetype=MSG OR sourcetype=MTA) | rename 'filter.qid' as filter_qid, 'sm.qid' as sm_qid | eval qid=coalesce(filter_qid,sm_qid) | stats count by qid ... View more