I have syslog-ng configured on the same Splunk server to receive syslogs from our Cisco ASA with FireSIGHT. (Will be changing to a seperate syslog server eventually but need to solve this issue before the migration at a later date). The ASA firewall data is being sent to /var/log/cisco_asa and the FireSIGHT data is being sent to /var/log/sourcefire on the Splunk server from the ASA appliance. I have Cisco Security Center, eStreamer for Splunk, Splunk Add-on for Cisco ASA, and Splunk Add-on for Cisco FireSIGHT installed. I have the /var/log/cisco_asa folder being monitored via Splunk's local inputs under the cisco:asa sourcetype and I am able to see the firewall data with charts on Cisco Security Center app but I am not sure how to see the FireSight IPS data with charts. What sourcetype should I set it up under and what app should I use to see the data? I tried the eStreamer for Splunk app and it seems to only work if data is forwarded from the estreamer port, but not syslog. ... View more

I have this search of events: eventtype=cisco-firewall src_ip="*" (dest_ip="192.168.1.2" OR dest_ip="192.168.2.2" OR dest_ip="10.10.1.1" ) For each src_ip, I'd like to list the dest_ip and the count of src_ip so it'd like look src_ip | dest_ip | count 212.123.123.123 | 192.168.1.2, 10.10.1.1 | 123 215.123.123.123 | 192.168.1.2, 10.10.1.1 | 55 214.23.23.23 | 192.168.2.2 | 894 211.45.55.55 | 192.168.1.2, 192.168.2.2, 10.10.1.1 | 235 ... View more

I have a saved search of last hour activity from our firewall and using the cluster map visualization plugin. When I create an alert for this search and enable attachment of PDF, it shows this weird plot. Why won't it show the geographical country map w/ the cluster bubbles? ... View more

This is my search below. It shows Country and count. How do I sort the count field for largest to smallest? index="cisco_asa" src_ip="*" dest_port="*" action="blocked" | fields src_ip | iplocation src_ip | stats count by Country ... View more

I would like a saved search to be ran on the 1st of each month with data from the previous month and have it emailed to me. I see that under Save As -> Alert, I can choose Scheduled and "Run every month" but where do I I tell it to run the search for the previous month? ... View more

I followed this guide from Tenable and installed the Splunk Add-on for Tenable to add my on-premise scanners and when I look up nessus sources, I only see these log sources: /opt/splunk/var/log/splunk/splunk_ta_nessus_tenable_sc.log /opt/splunk/var/log/splunk/splunk_ta_nessus_ucc_lib.log /opt/splunk/var/log/splunk/ta_nessus.log What do I need to do to see scan data from Tenable.io? ... View more

I've been waiting for over an hour and my search is still running with over 50 million events so far. I'm tempted to just stop it but how do I know how many total events I have and when it should end? ... View more