Hello, I am trying to monitor an application log and have Splunk generate an alert only when the  service_status = "disconnected" and  service_status="connected" entries are logged and the time between the two is greater than the span of 10 seconds OR if the Service_status = "disconnected" is the only entry being logged.   I've been experimenting with the transaction command but I am not getting the desired results.  Thanks in advance for any help with this. Example log entries: --- service is okay, do not generate an alert.--- 9/2/2022 00:10:36.683   service_status = "disconnected" 9/2/2022 00:10:38.236  service_status="connected"   --- service is down, generate an alert.--- 9/2/2022 00:10:40.683   service_status = "disconnected" 9/2/2022 00:10:51.736  service_status="connected"   --- service is down,  service_status="connected" event is missing,  generate an alert.--- 9/2/2022 01:15:15.603   service_status = "disconnected"   ... View more

Hello, I have an application that logs a "appsvr disconnected" and a "appsvr connected" message in the app log.  I have created the extraction called connectionstatus to indicate as such.  I would like to create a Splunk alert to notify me only when the connectionstatus = "appsvr disconnected" appears in the log and it is not followed by a connectionstatus = "appsvr connected" in a 30 second window.  I am trying to cut down on the false positives, it seems fairly straight forward but I haven't been able come up with a search that would satisfy this condition.  Any help is greatly appreciated.  Thanks! Conditions: connectionstatus="appsvr disconnected" appears in the log by itself for 30 seconds or more - Alert.  connectionstatus="appsvr disconnected" appears in the log but the connectionstatus="appsvr connected" also appears in a 30 second window - False positive, don't alert. -Magnus ... View more

Hello, I have Splunk Enterprise 6.2.5 running in a distributed environment and I can't seem to get the Nessus Add-on 4.0.0 to work. I have it installed on one of my search heads and configured as follows but I am not getting any data written to the nessus index. Am I missing something? Thanks in advance for any help. inputs.conf [nessus://nessus_scan] interval = 86400 url = https://myserver.myco.com:8834 access_key = ******** secret_key = ******** start_date = 2015/01/01 page_size = 1000 metric = nessus_scan batch_size = 100000 index = nessus [nessus://nessus_plugin] interval = 604800 url = https://myserver.myco.com:8834 access_key = ******** secret_key = ******** start_date = 2015/01/01 page_size = 1000 metric = nessus_plugin batch_size = 100000 index = nessus ta_nessus.log 2015-11-20 10:15:23,386 INFO pid=8117 tid=MainThread file=nessus.py:main:260 | Start nessus TA 2015-11-20 10:15:23,525 INFO pid=8121 tid=MainThread file=nessus.py:main:260 | Start nessus TA 2015-11-20 10:15:23,589 INFO pid=8117 tid=MainThread file=nessus_config.py:get_nessus_conf:80 | Try to get encrypted proxy username & password 2015-11-20 10:15:23,590 INFO pid=8117 tid=MainThread file=nessus_config.py:update_nessus_conf:66 | Update nessus.conf 2015-11-20 10:15:23,590 INFO pid=8117 tid=MainThread file=nessus_config.py:_encrypt_nessus_conf:198 | Encrypt the proxy username & password 2015-11-20 10:15:23,590 INFO pid=8117 tid=MainThread file=nessus_config.py:_encrypt_nessus_conf:206 | Proxy username is empty. Try to delete the encrypted proxy username & password 2015-11-20 10:15:23,657 INFO pid=8121 tid=MainThread file=nessus_config.py:get_nessus_conf:80 | Try to get encrypted proxy username & password 2015-11-20 10:15:23,657 INFO pid=8121 tid=MainThread file=nessus_config.py:update_nessus_conf:66 | Update nessus.conf 2015-11-20 10:15:23,657 INFO pid=8121 tid=MainThread file=nessus_config.py:_encrypt_nessus_conf:198 | Encrypt the proxy username & password 2015-11-20 10:15:23,657 INFO pid=8121 tid=MainThread file=nessus_config.py:_encrypt_nessus_conf:206 | Proxy username is empty. Try to delete the encrypted proxy username & password 2015-11-20 10:15:23,667 INFO pid=8117 tid=MainThread file=nessus.py:get_nessus_modinput_configs:142 | Set loglevel to WARN 2015-11-20 10:15:23,738 INFO pid=8121 tid=MainThread file=nessus.py:get_nessus_modinput_configs:142 | Set loglevel to WARN /opt/splunk/var/lib/splunk/modinputs/nessus/nessus_scan_nessus_scan.ckpt { "https://myserver.myco.com:8834": { "start_date": "2015/01/01", "scans": { "80": { "hosts": [], "history_id": 81 }, "74": { "hosts": [], "history_id": 75 }, "5": { "hosts": [], "history_id": 6 }, "12": { "hosts": [], "history_id": 149 }, "126": { "hosts": [], "history_id": 154 }, "8": { "hosts": [], "history_id": 76 }, "70": { "hosts": [], "history_id": 147 } } } } ... View more

Hello, I am using Splunk Enterprise 6.2.3 Universal Forwarder to monitor events from the Security log on a Windows server. I need to be able to blacklist all events with SourceName = "Microsoft Windows security auditing." and SourceName="Microsoft-Windows-Eventlog". Can this be done? I can blacklist EventCode with a UF but the SourceName doesn't seem to work. Thanks! This works... [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4747" blacklist2 = EventCode="4858" This does not... [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = SourceName="Microsoft-Windows-Eventlog" blacklist2 = SourceName="Microsoft Windows security auditing." ... View more

Hello, We are in the process of setting up a Spunk 6.2.3 distributed environment with a dedicated search head, indexer and deployment server. We installed enterprise Splunk on all three servers and applied the license but not sure what to do next. Is there a way to configure the servers for their specific roles and remove unnecessary ones? We couldn't find step-by-step instructions in the Splunk documentation. Thanks! ... View more