cpetterborg cheers to you Sir. You have helped me and I am eternally gratefully for you assistance. ... View more

{"connection_destination_type":"CATO","severity":"ALERT","sourceCountry":"United States","creationTime":"Jun 12, 2017 9:55:11 PM","tunnel_client_version":1,"accountName":"OpenTunnel","tunnel_type_name":"DTLS","count":1,"start":1497304511000,"type":"Health","tunnel_creation_time":1497304510,"popName":"Chicago","health_rule_id":368,"sourceIp":"71.16.39.186","prettyType":"Changed Pop","tunnel_connection_reason":"Switched to pop Chicago from pop Guadalajara","network_interface_name":"","end":1497304511000,"subType":"Changed Pop","sourceName":"Biggy Small","events":[{"time":"Jun 12, 2017 9:55:10 PM","sourceType":"ACCESSLOGIN","sourceIP":"71.16.39.186","popName":"Chicago","interfaceName":"","status":"Connected","color":"#76B21C"}],"siteType":"ACCESSLOGIN"} ... View more

sorry but my regex command is being edited. ... View more

This is my command minus the two astericks before and after the search command index="cato_dev" | rex field=type (?.*) ... View more

I tried your regex and unfortunately did not work. My rex command did add my the new sourcetypes as a search. index="cato_dev" | rex field=type (?.*) with the above it added sourcetype: Health, AuditTrail, Security ... View more

Hi cpetterborg, I unfortunately started with "FORMAT = sourcetype::$1" with the same effect. ... View more

Currently I am able to create the new sourcetypes with the following rex command, but still have a problem with either the props or transforms conf file. I guess there is a syntax issue. This works > index="cato_dev" | rex field=type "(?.*)" sourcetypes:Health;AuditTrail;Security transform.conf [cato:logs] REGEX field=type "(?.*)" FORMAT = sourcetype::cato:logs DEST_KEY = MetaData:Sourcetype props.conf [cato:logs] CHARSET = UTF-8 SHOULD_LINEMERGE = True KV_MODE = json TRANSFORMS-changesourcetype = cato:logs [source::/opt/splunk/etc/apps/Cato_Input/CATOLOG.TXT] TRANSFORMS-changesourcetype = cato:logs ... View more

currently the following rex command is creating new sourcetypes, but I still need assistance the props or transforms conf files. index="cato_dev" source=CATOLOG.TXT | rex field=type "(?.*)" adds the Health, AuditTrail and Security sourcetypes props.conf [cato:logs] CHARSET = UTF-8 SHOULD_LINEMERGE = True KV_MODE = json TRANSFORMS-changesourcetype = cato:logs [source::/opt/splunk/etc/apps/Cato_Input/CATOLOG.TXT] TRANSFORMS-changesourcetype = cato:logs transforms.conf [cato:logs] REGEX field=type "(?.*)" FORMAT = sourcetype::cato:logs DEST_KEY = MetaData:Sourcetype ... View more

I appreciate your recommendation, but I have been tasked with the segmenting of the different logs with individual sourcetypes as the data is combined from the cloud firewall. ... View more

With this I simply moved the "type" field into the "sourcetype" field, but I want the values from "type" into "sourcetype". REGEX = type=(?P[^;]+); FORMAT = sourcetype::$1 DEST_KEY = MetaData:Sourcetype ... View more

Yes, we want to split the log sources by sourcetype. ... View more

The reason for the new sourcetypes , each of the values represent a different log source as I am parsing data from a firewall. ... View more

Appreciate you responding to my question. I would like to do query my data at search time. field=type value=Health,AuditTrail,Security Need to create new sourcetypes with each value: sourcetype=Health;sourcetype=AuditTrail;sourcetype=Security Thanks, Paul ... View more

I added the following to the confcheck_es_app_version job, but still getting the error 3 messages. ES Version 4.7.0 ((streamfwd|splunk-(wmi.path|MonitorNoHandle.exe|winevtlog.exe|netmon.exe|perfmon.exe|regmon.exe|winprintmon.exe|admon.exe|powershell.exe)).*exited with code 1)|(confcheck_es_app_version.*exited with code 3) Please let me know if you had any luck using the suppression field and post the command that was effective. Thanks, Paul ... View more

Question regarding log files that are required for indexes created in the architecture exam. If you we need to index data from the example.xml file and their many other *.log files not need for the required index. Would there be points deducted from the exam grade if the unnecessary *.logs removed from the directory with the example.xml file? Thanks, Paul ... View more

Hi Asimagu, I appreciate your reply, but I had reviewed the logs on the OSSEC site and was not able to find the appropriate log that contained the fields needed. /Paul ... View more

Relatively new user of Splunk and have noticed a possibly bug with the "Clone to Inline Pivot" functionality when editing a Dashboard Panel by clicking on the Search Report icon in order to use a Time Range Picker for Panels in a Dashboard. This will be very handy function to synchronize all panels in a dashboard. I click on Inline Search icon, choose "Clone to Inline Pivot" and it does not change the icon to Inline Search, hence not prompted to add the Time Range Picker to the panel. I am using Splunk Enterprise 6.5.1 Thanks, Paul ... View more