If the syslog receiver is using UDP you can't test it with telnet, instead try netcat. nc -z -v -u <your_IP> <your_port_number>   Although, a good start is to use netstat on the recieving host and confirm the host is listening on the right interface/port/proto! netstat -ln|grep <your_port_number>   ... View more

try changing it to    if(action="File quarantined","blocked",action)   That looks to me like the intent is to re-write the action to be "blocked" for a quarantine message, otherwise leave action as it was if (action = quarantine, re-write it as action="blocked", otherwise set action=action( i.e whatever it already was) )     ... View more

@gozdeyildizz Thats great news! Don't forget to accept an answer and upvote posts that helped you!  ... View more

Did you set ratio to match the search sample ratio? I am guessing you are not using sampling, so set the ratio=1 ... View more

I think ( @priyastalin correct me if wrong) it looks like this is just so you can filter on the groupId? I'm not sure if seeing the contents of the macro would help to understand if its doing a simple filter or if there is something more complex going on to get the set of results. If this is something you run frequently, I think a lookup might be a far simpler (and faster) approach. ... View more

Splunk does not record licence consumption per event but you can make a good guess on this yourself. Build a search which includes your events, and calculate the size in bytes of each event over 24 hours   index=wineventlog sourcetype=winlog EventCode=4688 earliest=-24h latest=now|eval bytes=len(_raw)    Splunk uses UTF-8, so its 8bits, 1 byte per character. Each event will be slightly different with varying hostnames and other parameters etc so calculate an average.   |stats avg(bytes) as avg_bytes     Now you need to know how many events there have been - I presume its a lot - a.) because you are asking, and b.) because 4688 is common and noisy! You could run a |stats count over 30 days, but that may take some time. (Im also working on the assumption you don't have an accelerated datamodel for this) This is a good use case for a sampled search, set a sample rate that matches your dataset. 1:10,000 or 1:100,000 is probably the ballpark. To calculate the volume, you need to multiply the number of events the samples search returns by the avg_bytes and then multiply that by the ratio you choose.   So the complete search would be:   index=wineventlog sourcetype=winlog EventCode=4688 | eval bytes=len(_raw) | stats avg(bytes) as avg_bytes count | eval ratio=10000 | eval consumptionBytes=((avg_bytes*count)*ratio) | eval consumptionKB=((avg_bytes*count)*ratio)/1024 | eval consumptionMB=((avg_bytes*count)*ratio)/1024/1024 | eval consumptionGB=((avg_bytes*count)*ratio)/1024/1024/1024    remember to set "|eval ratio=x" to the sample ratio you use for the search ... View more

It might help if you can also post the contents of the macro  last_np_sourcetype() ... View more