About danbrook

danbrook · ‎02-18-2020

Similar setup for me but I have 1 FMC and 1 Indexer. I have multiple domain on the FMC and am trying to send logs to seperate indexes. Can the same client.pkcs12 file and password be used under each domain?

danbrook · ‎02-14-2020

I too would like to know this. I have one FMC with multiple domains. I would like to send each domain to a custom index and/or be able to select the domain/index from the dashboard. I'm not sure of the best way to approach this.

danbrook · ‎11-13-2019

I too am having the same issue. I'd like to understand exactly how this works.

danbrook · ‎06-01-2017

The Intermediate Forward is a Universal Forwarder. The custom metadata is being added to the logs.

danbrook · ‎06-01-2017

SOURCE_KEY = field:customfield - This didn't work I'm afraid.

danbrook · ‎06-01-2017

The custom field is set like this on the intermediate forwarder: [default] _meta = customfield::ACustomString

danbrook · ‎06-01-2017

I am collecting Windows Event Logs via either a Windows Event Collector or directly from each Windows server (with a Splunk UF installed). I am then using an intermediate forwarder to send to our indexers. This is due to network setup and location of the servers. I have custom metadata that the intermediate forwarder is adding to identify where the logs are coming from and use in the index name. The problem I am having is that the Windows Event Logs are hitting the Main index and not the one I've specified in transforms. On the intermediate forwarder I have: inputs.conf [splunktcp:9997] acceptFrom = * On the destination Indexer I have: props.conf [source::WinEventLog:ForwardedEvents] TRANSFORMS-Host = Set-Host-ComputerName TRANSFORMS-LogName = Set-Sourcetype-LogName TRANSFORMS-Index-Windows = Set-Index-Windows [sourcetype::WinEventLog:*] TRANSFORMS-Index-Windows = Set-Index-Windows ... transforms.conf [Set-Host-ComputerName] REGEX = (?m)ComputerName=(.+)?\b DEST_KEY = MetaData:Host FORMAT = host::$1 [Set-Sourcetype-LogName] REGEX = (?m)LogName=(.+)?\b DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::windows:event:$1 [Set-Index-Windows] SOURCE_KEY = MetaData:customfield REGEX = (.+) DEST_KEY = _MetaData:Index FORMAT = index-$1-win-event

danbrook · ‎03-24-2017

We are planning on some long and detailed index names. I'd like to know if there is a maximum length an Index name can be?

danbrook · ‎03-16-2017

Ah ha! Yes I add the MyCustomField on the input from a Universal Forwarder. I want to set the index name based on the value in MyCustomField so maybe I can match in props.conf for the source and then pull out the value for MyCustomField to build the Index name. props.conf [source::syslog] TRANSFORMS-Index-Syslog = Set-Index-Syslog transforms.conf [Set-Index-Syslog] SOURCE_KEY = MetaData:MyCustomField REGEX = (.*) DEST_KEY = _MetaData:Index FORMAT = index-$1-Syslog

danbrook · ‎03-16-2017

Yes, edited.

danbrook · ‎03-16-2017

I'm looking to match against two fields in transforms.conf. I would like to match against a customer _meta field and the source field then route to a specific index based on that. There is a good reason for me not matching on inputs.conf that I won't go into here. I would like to match regex=MyCustomField::somestring AND regex=source::syslog I'd also like to be able to test this in search before committing it to transforms.conf

danbrook · ‎02-18-2017

That's now working! Thanks. Just a though, do I need the SOURCE_KEY part?

danbrook · ‎02-18-2017

Thanks Martin! That's working now. I must admit I'm still fuzzy on the why but I'm getting there. Many more Splunk Docs to read!

danbrook · ‎02-18-2017

OK, I now have this: transforms.conf [Set-Index] SOURCE_KEY = MetaData:Source REGEX = source::WinEventLog:ForwardedEvents DEST_KEY = _MetaData:Index FORMAT = MyIndex The logs are still hitting the main index.

danbrook · ‎02-18-2017

Thanks, just spotted that. Corrected but logs still aren't being match or changed. So either the Regex is wrong or..?

danbrook · ‎02-17-2017

I'm trying to set up Windows Event Log collection via chained Universal Forwarders to my Indexer. I'm not able to set the index in inputs.conf so am trying to set it on the indexer but with no luck. I'm also manipulating the source ype and host field to show the original values, which is working fine. So far I have: props.conf [source::WinEventLog:ForwardedEvents] TRANSFORMS-Index = Set-Index TRANSFORMS-Host = Set-Host-ComputerName TRANSFORMS-LogName = Set-Sourcetype-LogName transforms.conf [Set-Index] SOURCE_KEY = MetaData:Source REGEX source::WinEventLog:ForwardedEvents DEST_KEY = _MetaData:Index FORMAT = index::MyIndex** [Set-Host-ComputerName] REGEX = (?m)ComputerName=(.*)?\b DEST_KEY = MetaData:Host FORMAT = host::$1 [Set-Sourcetype-LogName] REGEX = (?m)LogName=(.*)?\b DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::WinEventLog:$1 My struggle is with setting the index at index time.

Posts	16
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎02-17-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Change index at index time (chained UFs)

Maximum length of an Index name

Regex to match two fields in transforms.conf

Set index on indexer

Re: How to connect multiple instances of Cisco Fir...

Re: Multiple Indexes from single Firepower Managem...

Re: How to add _meta to all entries from forwarder...

Re: Change index at index time (chained UFs)

Re: Change index at index time (chained UFs)

Re: Change index at index time (chained UFs)

Change index at index time (chained UFs)

Maximum length of an Index name

Re: Regex to match two fields in transforms.conf

Re: Regex to match two fields in transforms.conf

Regex to match two fields in transforms.conf

Re: Set index on indexer

Re: Set index on indexer

Re: Set index on indexer

Re: Set index on indexer

Set index on indexer

Join the Conversation