Hi everyone! i logged into my search head and found that the main indexer was at 98% of the total capacity. So i started to look for which host/sourcetype was causing this. I found the search head itself was indexing too many events from audit.og (it has installed the splunk_TA_nix addon). Some examples are: type=PATH msg=audit(1551884420.778:495054861): item=4 name="/opt/splunk/var/run/splunk/dispatch/scheduler_[some_data]__search__[some_data]/[some_file_name].csv" inode=35130128 dev=ca:60 mode=0100600 ouid=0 ogid=0 rdev=00:00 nametype=CREATE type=PATH msg=audit(1551884420.778:495054861): item=3 name="/opt/splunk/var/run/splunk/dispatch/scheduler_[some_data]___search__[some_data]__at_1551884400_30928/[some_file_name]_.csv" inode=35129880 dev=ca:60 mode=0100600 ouid=0 ogid=0 rdev=00:00 nametype=DELETE So i made the next search to check which services were generating this logs index=main host="MY_SEARCH_HEAD" source="/var/log/audit/audit.log" | eval PATH=case(name LIKE "%/opt/splunk/%", "OPT Splunk", name LIKE "%/volr/splunk%", "Volr Splunk") | stats count by PATH | eventstats sum(count) as perc | eval perc=round(count*100/perc,2) The result is the next one: PATH: OPT Splunk Count: 2749262+ perc: 75% PATH: Volr Splunk Count: 2749262+ perc: 24% Why are this logs being generated, and how can i not overload my indexer? Thanks for reading! ... View more

I was making some SQL dashboard and i can't use some variables cause one of them is the kerberos USER that comes like: "MyDomain\User1" MyDomain\User2" MyDomain\User3" MyDomain\User4" My search is index="mssql" sourcetype="mssql:audit" | eval user=lower(server_principal_name) | search user="$m_user$" | table _time name user statement Where m_user is a dropdown input that populate this way: index="mssql" sourcetype="mssql:audit" statement!="" statement!="--*" server_principal_name!="*SYSTEM" | eval user=lower(server_principal_name) | dedup user (I use a lower function cause server_principal_name can be "MyDomain\USer1" or ""MyDomain\user1") The thing is when m_user get's the value (for example) "MyDomain\User1" the search didn't find result, but if i look for "MyDomain\user1" the search finds the events. I was trying to do a eval thing like: index="mssql" sourcetype="mssql:audit" | eval user=lower(server_principal_name) | search user="$m_user$" | eval user=replace(user,".+\\.+","\\\\") | table _time name user statement without success. Some idea? ... View more

I guys! i would like to count the fail and success logons on my SFTP. The events are Successfull Logins from different accounts: [40] Sat 24Feb18 01:53:49 - (1809219) HTTP_LOGIN: user: MYUSER; domain: cname.mydomain.com [31] Sun 25Feb18 20:05:03 - (1836845) SSH2_MSG_USERAUTH_SUCCESS: successful login Failed logins from different accounts: [31] Sun 25Feb18 20:05:03 - (1836845) SSH2_MSG_USERAUTH_FAILURE: login failed [41] Sat 24Feb18 01:53:38 - (1809216) HTTP_OKAY (200): SESS_FAIL So i made this search: index="sftp" SSHCommand="MSG_USERAUTH_SUCCESS" OR http_command=LOGIN OR SSHCommand="MSG_USERAUTH_FAILURE" OR Event_Message="*SESS_FAIL*" Event_Message="HTTP_OKAY (200): SESS_FAIL" | eval type=IF(SSHCommand="MSG_USERAUTH_SUCCESS" OR (Event_Message="HTTP_LOGIN: user:*"),"SUCCESS", IF(SSHCommand="MSG_USERAUTH_FAILURE" OR Event_Message="HTTP_OKAY (200): SESS_FAIL","FAIL","OTHER")) | stats list(Event_Message) by type But it returns "other" values that star with: HTTP_LOGIN: user: MYUSER; domain: cname.mydomain.com any ideas? ... View more

Hi Guys! i've got the next situation Trying to replace some characters in this events: \device\harddiskvolume4\windows\system32\dns.exe \device\harddiskvolume4\windows\system32\lsass.exe \device\harddiskvolume2\program files (x86)\fortinet\fsae\collectoragent.exe With this sentence: EventCode=5156 Application_Name = "*System32*" OR Application_Name = "*program files*" | eval mAppName=replace(Application_Name, ".+\\", "") but when i try to do it Splunk tells me "Error in 'eval' command: Regex: \ at end of pattern" Why is that? and how can i solve it? Thanks a lot for answers ... View more

Hi guys! I'm loking for a search like this: source="WinEventLog:Security" name = "A member *group*" Group_Name="*admin*" | table _time src_user user Group_Name name The search works great! the problem are the results, the "user" Column give me something like this: CN=MyUserDomain,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,OU=SomeOrgUnit,DC=com,DC=net I only wants to get "MyUserDomain". Is there anyway? I tried with eval user = trim(replace(user, "CN=", "")) but it only removes the first part of the string Thanks a Lot! Nahuel ... View more

Hi Guys! It's me again! A few days ago i was asking how can i eval some fields and get the total from them. Now i want to show those in a table format and for that, i made this search: index=MY_INDEX (FIRST_ACT=5 AND SECOND_ACT=2) OR (FIRST_ACT=5 and SECOND_ACT=4 and STAT_FLAG=0) OR (FIRST_ACT=5 and SECOND_ACT=4 and STAT_FLAG=4). This search returns 10 events, but, in fact, there 14 events. How i know that? Because i have another panel that show's me the same events, but with and eval expression and a Single Value accumulation: MySearch | eval UTCOD=if((FIRST_ACT=5 and SECOND_ACT=2), 1, 0) | eval UTCOQ=if((FIRST_ACT=5) and (SECOND_ACT=4) and (STAT_FLAG=0), 1, 0) | eval UTSQ=if((FIRST_ACT=5) and (SECOND_ACT=4) and (STAT_FLAG=4), 1, 0) | eval all_UT=UTCOD+UTCOQ+UTSQ | status sum(all_UT) as total So ...why is that? Why when i search with OR conditional the result is 10, but when the search is made with EVAL founds 14 events? Thanks a lot for help. ... View more

I have a couple events to search for 3 fields MySearch | eval UTCOD=if((FIRST_ACT=5 and SECOND_ACT=2), 1, 0) | eval UTCOQ=if((FIRST_ACT=5) and (SECOND_ACT=4) and (STAT_FLAG=0), 1, 0) | eval UTSQ=if((FIRST_ACT=5) and (SECOND_ACT=4) and (STAT_FLAG=4), 1, 0) | stats sum(UTCOD) as total, sum(UTCOQ) as total, sum(UTSQ) as total This provide's me just the last "total" that i'm sum (sum UTSQ) What i need is to get the total of the 3 evaluations UTCOD + UTCOQ + UTSQ with a Single Value as the sum of three. regards! ... View more

Hi guys! i'm going crazy trying to find a way to solve this problem. I'm trying to find the percentage of Non Cleaned Malware from my AV log. For that i have a field that contains the legends of "Cleaned", "Quarantined", "Unable to Clean", "Unable to Quarantine", "Unable to handle", etc. For me, all the events that has a result like "Unable to *" are non contained detections, so i made this search to compare the results and have the percentage value: source=malware.csv | stats count as total | append [search source=malware.csv Result="Unable to *" | stats count as nocont | eval resultado=nocont/total*100] |table nocont the result must be a Single Value with a number like "20%" Any suggestions? ... View more