Hello! I am trying to exclude a specific computer_name from showing up in our carbonblack index in Splunk using a Heavy Forwarder where the data is monitored on.  Below is an example of my props.conf & transform.conf props.conf [source::/var/data/events.json] TRANSFORMS-null = nullFilter transform.conf [nullFilter] REGEX = (?ms)(.*"computer_name":\s*"test-machine".*) DEST_KEY = queue FORMAT = nullQueue   Raw data in Splunk:       {"path":"/usr/sbin/abrt-server","md5":"9F469AA349AA64009C3DB7BE","sha256":"","command_line":"abrt-server -s","parent_path":"/usr/sbin/abrtd","parent_pid":546,"parent_guid":-390649270232,"filtering_known_dlls":false,"parent_md5":"97E3CDA03CB1A8CDF9","expect_followon_w_md5":false,"link_parent":"https://server-name:443/#analyze/00000000-0000-0000-0000-74e9a5a/1","username":"root","parent_create_time":1682147484,"pid":27474,"process_guid":"00000000-0000-0000-0000-0000000e","link_process":"https://server-name:443/#analyze/00000000-0000-0000-0000-99132070551e/0","link_sensor":"https://server-name:443/#/host/518","process_path":"/usr/sbin/abrt-server","cb_server":"server-name","type":"ingress.event.procstart","sensor_id":123,"computer_name":"test-machine","event_type":"proc","timestamp":1686123541}         List format data in Splunk (there are two ways the data is displayed in Splunk but the json file produced the above raw data)       { [-] cb_server: server-name command_line: abrt-server -s computer_name: test-machine event_type: proc expect_followon_w_md5: false filtering_known_dlls: false link_parent: https://server-name:443/#analyze/00000000-0000-0000-0000-74e9a5a/1 link_process: https://server-name:443/#analyze/00000000-0000-0000-0000-99132070551e/0 link_sensor: https://sever-name:443/#/host/123 md5: 9F469AA349AA64009C3DB7BE parent_create_time: 1682147484 parent_guid: -390649270232 parent_md5: 97E3CDA03CB1A8CDF9 parent_path: /usr/sbin/abrtd parent_pid: 546 path: /usr/sbin/abrt-server pid: 27474 process_guid: 00000000-0000-0000-0000-99132070551e process_path: /usr/sbin/abrt-server sensor_id: 123 sha256: timestamp: 1686123541 type: ingress.event.procstart username: root }         I have tried a few different regex entries but they keep failing. I was using a UF initially then read the Splunk docs and upgraded to a Heavy Forwarder but still keep getting the same problem. Can you please provide any assistance, would be very much appreciated. My initial aim is to get this working for a single machine then hopefully look to exclude multiple machines sharing a similar naming convention for example "PC123..." grateful if you can provide best way to tackle both scenarios.  Thanks! ... View more

Hello Splunk Community!   I was hoping if someone can help me out here. I have been having problems adding a third field to an existing query that generates statistical data for SSL expiring in the next 90 days.  I am able to get the fields "name" and "expirationDate" to display but cannot add a field "subject" to the equation here. Current search query is:     index="test" sourcetype="test:test1:json" source="test.test2" | spath path=ssl output=fred | rex field=fred max_match=0 "\"name\":\"(?<name>.*?)\"}" | rex field=fred max_match=0 "\"expirationDate\":(?<expirationDate>.*?)," | dedup name | eval bob = mvzip(name,expirationDate) | mvexpand bob | rex field=bob "(?<name>.*),(?<expirationDate>.*)" | eval t=now() | where expirationDate >= t AND expirationDate <= (t + 7776000) | eval expiry=strftime(expirationDate, "%F %T.%3N") | table host name expiry     Expected output is:   host            name              expiry abc              test1              2021-07-09 10:10:10.000   I want to add a new field "subject" which I did the following but whenever "expirationDate" is added to the equation I am getting no results.    index="test" sourcetype="test:test1:json" source="test.test2" | spath path=ssl output=fred | rex field=fred max_match=0 "\"name\":\"(?<name>.*?)\"}" | rex field=fred max_match=0 "\"expirationDate\":(?<expirationDate>.*?)," | rex field=fred max_match=0 "\"subject\":(?<subject>.*?)," | dedup subject name | eval bob = mvzip(name,expirationDate,subject) | mvexpand bob | rex field=bob "(?<name>.*),(?<expirationDate>.*),(?<subject>.*)" | eval t=now() | where expirationDate >= t AND expirationDate <= (t + 7776000) | eval expiry=strftime(expirationDate, "%F %T.%3N") | table host name expiry subject     Grateful if you could point out my mistake here! I believe it's a wrong expression but cannot figure it out (it works fine without the conversion of the expiration date, but it comes under 1 row, which is also no ideal as I am hoping to separate entries into different rows.   Thanks, MJA ... View more

Hello Splunk members! I currently have a search that produces "Users" connecting to certain "hosts" whereas the status of connection is "created". The output is displayed as | timechart span=d dc(users) by host Here is a sample of how my search currently look like: index=search "remote access" (host="1.1.1.1" OR host="2.2.2.2" OR host="3.3.3.3") | eval host = case(host="1.1.1.1", "server1", host="2.2.2.2","server2", host="3.3.3.3", "server3") | rex field=_raw "\shas\sbeen\s\(?P<status>(created))\." | rex field=msg "\(SPI=\s(?P<session_id>\w+)\)" | timechart span=d dc(users) by host Now my aim is to have a lookup file (User-site.csv) the lookup has 2 fields. 1. UserID 2. Site I would like to filter out users based on site. For example, I want my timechart to only produce results for site "ABC" where users connected to. In my lookup UserID is matched to their dedicated Site, however the current search has Users from all Site which is something I need to filter out. Note: The UserID on the lookup is not 100% a match to (users) field on the initial search so I think I need to have something like "LIKE" command to compare similar characteristics from my lookup UserID field with users and then filter out the events based on site code (i.e. ABC) I would appreciate your assistance with this, I have previously made this work but this time the lookup fields are not 100% match so I can't figure a way to use a LIKE command here. Thanks ... View more