I am writing a query to lookup processed web domains against a lookup list. I have defined a lookup named ss3url_lookup, with supported fields named "masktype", "maskid" and "kap_tld". "kap_tld" is used in this case as the input field and is a field extraction I have written, containing a sanitised domain name - the other two are intended to be output fields only and do not exist prior to the lookup. When running my lookup with the following query, the progress is stalled at the lookup - the query runs as far as the lookup, but no results are ever returned and the query eventually times out: sourcetype="access_combined_wcookie" | dedup kap_tld | lookup ss3url_lookup kap_tld | table kap_tld, masktype, maskid I have verified that the kap_tld field exists and contains all values as expected, going into the lookup. But I cannot work out why the lookup stalls as it does. Does anybody have experience of lookups not running, or know in what circumstances a lookup will stall in this way? If there is any more information I can provide, I'll be happy to do so. ... View more

I have two type of files i am inputted into splunk. Both reside at /var/data/proxy/isolde.2015060812.log or mimi.2015060515.log I can easily use the whitelist field with a regex to specifically point out which file i want to take. I want to to take them as separate inputs so each one can be assigned a different host value to be searched against. However when specifying the path a second time splunk returns an error: "path is the same and another input". So I edited inputs.conf manually to specify the path/sourcetype/host/whitelist regex. doing a ./splunk btool check returned no errors so i think it will work? Does anyone have any experience with this kind of scenario? Can you comment on using inputs.conf as a valid way to workaround the splunk error? ... View more

I have some very large lookup tables for known bad domains.(4m+ entries) the lookup has a field called 'kap_chk' which i want to match two searchtime extractions with. one is kap_uri the other kap_tld. To get them both to match i figured id use an alias for them; kap_chk. Therefore my props.conf and transform.conf would look like this: props.conf [access_combined_wcookie] REPORT-kap_uri = kapersky_uri REPORT-kap_tld = kapersky_tld FIELDALIAS-kapersky_uri = kap_uri AS kap_chk FIELDALIAS-kapersky_tld = kap_tld AS kap_chk transforms.conf [ss2url_lookup] filename = ss2url_lookup.csv case_sensitive_match = false [ss1url_lookup] filename = ss1url_lookup.csv case_sensitive_match = false [kapersky_uri] SOURCE_KEY = uri REGEX = (?:( http\:\/\/www\.|\w+:\/\/|www\.|)(?<kap_uri>.+)) [kapersky_tld) SOURCE_KEY = uri REGEX = (http|https|ftp)?(:\/\/)?(www\.)?(?<kap_tld>.+?)(\/|:).* In you're opinions is this the correct way to go about achieving this? in the end it should mean i can do the following: sourcetype="access_combined_wcookie" AND kap_chk="*" | dedupe kap_chk, | lookup ss1url_lookup kap_chk OUTPUT masktype maskid kap_chk | table masktype, maskid, kap_chk thanks ... View more

I want to add a field extracttion to props.conf that will extract a portion of the uri field to create a custom field called kap_uri. So eventually i can do the following: sourcetype=access_combined_wcookie kap_uri=* | lookup bad_url_lookup kap_uri OUTPUT maskid kap_uri | table kap_uri,maskid According to the docs i expected this to work as follows: [host::mimi] EXTRACT-kap_uri = (?:(http\:\/\/www\.|\w+:\/\/|www\.|)(?<kap_uri>.+)) in uri But when I search ("host=mimi kap_uri=* | table kap_uri") for the field in splunk nothing is returned. After searching some more a transform.conf edit was suggested so i have tried, #props.conf [access_combined_wcookie] REPORT-kap_uri = kapersky_uri #transforms.conf [kapersky_uri] SOURCE_KEY = kap_uri REGEX = (?:( http\:\/\/www\.|\w+:\/\/|www\.|)(?<kap_uri>.+)) Any ideas why this is not working, how can I get this field extraction,I tested the regex with rex field=uri "(?:(http\:\/\/www\.|\w+:\/\/|www\.|)(?&lt;kap_uri&gt;.+))" and it worked well ... View more

HI, I've installed the splice app after installing mongodb and created a user 'spadmin' for db 'splice' with admin permissions. When i log into splunk and open up the app for the first time i am receiving the below error: ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/SA-Splice/bin/taxii.py" ERRORglobal name 'Except' is not defined any ideas? ... View more

Hi, I've just installed the splunk-on-splunk app on our splunk deployment... A pretty small deployment that's single tier, i was under the impression the app came with premade dashboards for checking the health of ones deployment? Is this true? becuae when i select the app i am greeted by a blank screen and an invitation to start creating panels. Which i'd gladly do but i have zero reference on what kind stuff i'm going to query. In this case can someone point me in the right direction for a reference on how to query the sos db. thanks ... View more