Hey Splunkers, Our securty team really likes the Identity Investigator dashboard. Only things is -- it would be GREAT to add a few more swimlanes of custom sourcetypes (for example, our DNS, Proxy...etc). I see you can edit, remove, rename the default sourcetypes, but is there anyway to add a new one? Looked at the code underneath and everything seems pretty hard-coded. Is there a best-practices approach? Thanks! ... View more

Stumped on a regex problem and need a hand. Basically, I have DNS logs that come in like this: 8/21/2014 9:32:20 AM 0E5C PACKET 000000298F0CA280 UDP Rcv 10.2.56.13 136b Q [0001 D NOERROR] PTR (2)25(2)21(1)5(2)10(7)in-addr(4)arpa(0) 8/21/2014 9:32:20 AM 0E60 PACKET 000000298EE81DF0 UDP Rcv 10.2.4.60 7d30 Q [0001 D NOERROR] A (14)usca-cdst-sw01(3)domain(3)com(0) 8/21/2014 9:32:20 AM 0E60 PACKET 00000029936FBF70 UDP Rcv 10.2.4.60 ce83 Q [0001 D NOERROR] A (14)usca-edge-sw01(3)domain(3)com(0) 8/21/2014 9:32:20 AM 0E60 PACKET 00000029936FBF70 UDP Rcv 10.2.4.60 db29 Q [0001 D NOERROR] A (14)usxo-core-vg02(3)domain(3)com(0) 8/21/2014 9:32:20 AM 0E60 PACKET 000000298EE81DF0 UDP Rcv 10.2.4.60 42b1 Q [0001 D NOERROR] A (14)brca-rvrb-wo01(3)bru(3)domain(3)com(0) Towards the end of each event, you'll see something like, "(14)ussp-usrv-rt01(3)domain(3)com(0)" Basically, I'm trying to write regex to convert this into "ussp-usrv-rt01.domain.com" My strategy was to capture everything after NOERROR]\s+\w+\s+ to end of line, then replace the parenthesis with a period. Having trouble getting it just right. Any suggestions? Thanks! ... View more

Hey Splunkers, I'm getting an error in _internal that I can't seem to figure out. Every enabled app that has a csv lookup is throwing this error in splunkd.log. These happen quite frequently -- adding up to 100,000 a day! 😞 Environmont Details: Splunk 6.1. Enterprise Security 3.1 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=identities_expanded.csv in lookups.conf, cannot enumerate fields list 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=pci_domains.csv in lookups.conf, cannot enumerate fields list 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=pci_domains_from_assets.csv in lookups.conf, cannot enumerate fields list 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=assets.csv in lookups.conf, cannot enumerate fields list 06-26-2014 04:24:00.807 +0000 WARN TransformsExtractionHandler - Unable to find stanza=identities.csv in lookups.conf, cannot enumerate fields list Why would Splunk complain about every csv lookup in my environment??? I don't get any syantax errors when I start splunk. Any help would be greatly appreciated. Thanks! ... View more

Hey Splunk Gurus, I'm writing a custom Splunk 6 web framework application and I'm trying to get the username server-side. I know this sounds very (very!) simple, but I can't seem to get it. The username keeps coming up blank. Starting with a completely new app, I enter the following: @render_to('my_app:home.html') @login_required def home(request): service = request.service logger.debug(service.username) return { "message": service.username, } I couldn't get that to work, so I said "screw it -- I'll just use REST". That got me close but no cigar: josh_rest = service.get('/services/authentication/current-context') logger.debug(josh_rest.body) #this displays the XML I did end up getting the XML for the REST endpoint (which does indeed contain the logged in username!) but I can't figure out how to use splunklib.data.load() to parse it effectively. I even saw this in the documentation (but it doesn't work for me) Anyhow, if you have any insight into how to get the username, please let me know. Thanks!! ... View more