We installed the Linux Auditd app, when we ran the config the auditd_indicies lookup found nothing and auditd_indicies.csv is empty. If we do a general search on our standalone search head and our cluster we see sourcetypes with linux:auditd? Has any one ran into this issue in the past? We are on version 2.0.3 ... View more

Hi All, Does anyone have a search/report that shows all of your indexes with usage by day vs the previous day with a column for percent change? ... View more

Hello, I have a search (see below) that Im having a little trouble with. With it it returns the fields correctly, but its just a lot of ORs (like src_ip=1 OR src_ip=2 OR src_port=1 OR src_port=2). What Im trying to figure out is, how would I write the query so that the inner search would return the fields in groups to the outer search like (src_ip=1 AND src_port=1 AND dst_ip=1 AND dst_port=1). Any thoughts? THANKS! index=firewall sourcetype=juniper_vgw action=allow ip_proto!=17 rule_id!=263 [search index=firewall sourcetype=vmware:dfw rule_id=6710 NOT UDP | fields src_ip src_port dst_ip dst_port] ... View more

Hi All, The default behavior when building a dashboard with checkboxes is that the checkboxes equal an AND search. Is there a way to change the behavior to be OR? For example, I have ten checkboxes index1 index2 index3....... When I do the checkboxes (and choose 2) the search comes out to be "index=1 index=7". I would like it to be "index=1 OR index=7" thank you, -Bryan ... View more

I know Im likely missing something easy, but I cant seem to get the output how I would like. I have the below search that works great to find the percentage available but I would like to make this into a pie chart with Available and Unavailable numbers index=nagios tag::src_host=collaboration (perfdata="HOSTPERFDATA" hoststate) OR (name="check_smtp" perfdata="SERVICEPERFDATA") | eval availabilityStatus=if(hoststate="DOWN" OR severity="CRITICAL","Unavailable","Available") | stats count(eval(availabilityStatus="Unavailable")) as unavailCount, count(eval(availabilityStatus="Available")) as availCount, count as totalCount | eval percentAvailable=(availCount/totalCount)*100 thanks all ... View more

Hello, I have nagios feeding data into splunk. The below searches give me ping (up, down) and a service check (ok, critical). While the separate searches seem to work great, I would like to combine them and have a overall uptime percentage for availability, and in the future will likely add more nagios checks to combine. Both searches have a similar Server field. index=nagios perfdata="HOSTPERFDATA" tag::src_host=collaboration hoststate | eventstats count as "totalCount" | eventstats count as "choiceCount" by hoststate | eval percent=(choiceCount/totalCount)*100 | stats values(percent) by hoststate index=nagios name="check__smtp" AND perfdata="SERVICEPERFDATA" tag::src_host=collaboration | eventstats count as "totalCount" | eventstats count as "choiceCount" by severity | eval percent=(choiceCount/totalCount)*100 | stats values(percent) by severity thanks. ... View more

Hello I have the below search and it seems to work fine for the most part. The problem is that if search 2 does not have any results the information gathered from search 1 is not displayed. The log line with the simta_ublstatus field can either exist or not exist for the user. There's likely a better way to do this so Im open for suggestions. index=collaboration tag::host="outbound" sourcetype="simta" | geoip simta_client_ip | stats dc(simta_client_ip_country_name) as country_count values(simta_client_ip_country_name) as country_name values(simta_client_ip_city) as country_city values(simta_client_ip) as IPAddress by simta_authuser | rex field=simta_authuser mode=sed "s/@umich.edu*//" | sort by country_count | search country_count>1 | join simta_authuser [search index=collaboration tag::host="outbound" sourcetype="simta" UBL | eval simta_authuser = simta_ublauthuser | fields simta_authuser simta_ublstatus ] ... View more

Hello I have the following searches below. The simta_smtp_authuser is the same username as the simta_ublauthuser of the second search. What Im trying to do is include the stat results from search 2 into the table of search 1 and rename the simta_ublauthuser to simta_smtp_authuser so that sorting will group everything together. index=collaboration sourcetype="mail-2" Auth [search index=collaboration sourcetype="mail-2" | fields simta_ublauthuser | dedup simta_ublauthuser | return 500 $simta_ublauthuser] | fields simta_client_ip simta_smtp_authuser | dedup simta_client_ip | geoip simta_client_ip | sort simta_smtp_authuser simta_client_ip | table simta_smtp_authuser simta_client_ip simta_client_ip_country_name simta_client_ip_city thanks a bunch everyone. hope that makes sense. index=collaboration sourcetype="mail-2" UBL | stats count by simta_ublauthuser simta_ublstatus ... View more