Trying to use multiple searches to get a percentage of total servers to be restored and total currently restored but can not get all values to be shared. I know it is the construct or the searches but can not figure out the issue, need some help to get the format right. Here is the search that uses indexed data and lookup files: |inputlookup DRServerList.csv |search PhysicalVirtual=P (Platform!=IP* AND Platform!=link*) |stats count as allPhys |append [search index=main sourcetype=ssdr Result=good | rex field=_raw "^(?:[^ \n]* ){6}(?\w+):\s+(?P.)(?:[^ \n] ){2}(?P\w+)\s+::\s+(?P\w+)(?:[^ \n]* ).::\s(?P.+)" |dedup Node | eval HostName=lower(Node) | join [inputlookup DRServerList.csv |search PhysicalVirtual=P (Platform!=IP AND Platform!=link*) |eval HostName=lower(HostName)] | stats count(eval(HostName==lower(HostName))) AS restore] | eval mypercent=(restore/allPhys*100) |table allPhys restore mypercent ... View more

I have searched the Answers site and cannot find an answer to why I get log off events, but intermittently am missing log on events in Splunk. This is a big problem for us and I have opened a ticket with Splunk Support but that also went nowhere and am hoping someone has had this issue and found a cause/fix. We on occasion see log off events, but cannot find the log on event anywhere. We do have a product called Adiscon that also grabs event log entries and it always has both events. We are using the Splunk_TA_Windows add-on with the following settings: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist = 560,562,565-567,4656-4658,4661-4663,4928-4934 index = wineventlog renderXml=false Hoping someone can help. ... View more

I have looked at answers for this already, but when I try any of them, my search still shows the unmasked data. Sample data: 10.98.112.52 - myid [06/Oct/2015:09:42:39 -0400] "GET /mySeal/VUEIT/myPortal/ApplicationSelection/CheckDeatilsSSN?SSN=123-45-6789&TAXID=&RecipientType=Agent&_= HTTP/1.1" 200 22 Tried the following: props.conf: [source::WebProxy] TRANSFORMS-anonymize = ssn-web-anonymizer transfoms.conf: [ssn-web-anonymizer] REGEX = (?m)^(.*)SSN=\d\d\d\-\d\d\-\d\d\d\d(\&.*)$ FORMAT = $1SSN=###-##-####$2 DEST_KEY = _raw Also tried: props.conf: [source::WebProxy] SEDCMD-hidessn=s/(SSN=\d{3})\-(\d{2})\-(\d{4})/SSN=xxx\-xx\-xxxx/g What am I doing wrong? Again I need the data masked no matter where the search is being done. ... View more

For instance I have 1400 forwarders with the Windows TA app deployed but am trying to find which ones are not reporting at all and how many stopped reporting in the last few days. ... View more