I'm currently using SQS Based s3 input for cloudtrail and I'm trying to drop nosey events such as GET and LIST. The documentation says the standard input supports exclude_describe_events and blacklist to filter out unwanted events which I set but after further looking into it it seems that a props/transform is needed.    I have configured the following in props and transforms props.conf [aws:cloudtrail] TRANSFORMS-filter = eventsDrop transforms.conf #Filters out events that are not needed [eventsDrop] REGEX = "^Describe|Get|List\p{Lu}|LookupEvents" DEST_KEY = queue FORMAT = nullQueue   I tested the regex and it matches events but the events are not being dropped as expected. This is on a HF as that collects the logs before going into indexers  ... View more

I have a requirement to see which users have logged into multiple servers before logging out of the previous server.   I currently have this Search Set up:  index="fed-prod" L_Action="New session" | stats values(L_Server) as Linux_Server dc(L_Server) as host_count by L_user |where host_count > 1   This search finds all the users who have logged  to multiple servers but does tell me if they have logged out of the other server first or allow me to narrow the time down to within a certain window.  I currently do not have a active feed into splunk and upload data manually do to licensing restrictions   The report would need to be ran weekly. I would like to do this one of two ways. First option would be add in a time premaster to the current above search that checks the time stamp of the log for it to be within a 15 minute window if the user logged into two. If the time stamps of the two logs are within 15 minutes it out puts a finding of the User and servers it logged into.  The second option would be to to do some sort of sub search. that would check to see which users logged in to what servers. then check to see if they logged out before logging into another one.      ... View more