Office Hours Q&A Q: Are there any MacOS equivalents to WinEventLogs we can pull into Splunk? I mean, one to one codes. If I wanted to get the same functionality that wineventlogs do, but for mac A: There are event IDs for apple products, but I don't I don't believe we have any of that functionality built into the UF right now (submit a feature request in Splunk Ideas). Q: I only have a 2GB license, so I’m trying to limit the amount of data that’s ingested by doing at the inputs.conf rather than busting my license. A: Use an ingest action to manipulate the data before you index it. And that happens before your licensing. So what i'm doing is, i'm forwarding that data in, and before I actually index it, I can actually manipulate that data. I can change source types, etc. Q: When is it best to have logs ingested directly to the Splunk ES search head versus the Splunk Heavy Forwarder? A: This is one of those “what works better for my deployment” scenarios. Splunk Best Practice is to utilize dedicated Search Head(s) for Enterprise Security and dedicated heavy forwarder(s) for data ingestion. Reasons for separation: Resource allocation, Access and configuration control, and Administration flexibility. Q: For Data Manager, when will AWS Organizations be supported? A: Check out the blog: Announcing the General Availability of Data Manager. Note that in order to get started you must be a Splunk Cloud Platform customer with AWS as your provider and be part of one of the AWS regions (US East Virginia, US West Oregon, UK (London), Europe (Dublin, Frankfurt, Paris), Asia Pacific (Singapore, Sydney, Tokyo), and Canada (Central). Q: What is the recommended way and time to normalize logs? ingest time, search time, etc. Any documented best practices? A: Check out the lantern article "How to Normalize Logs". There are four main ways to normalize data: (of course) key value pairs time={some time format} Index time: Use regex in your props.conf to grab unusual located timestamps in the logs Use the Common Information Model (CIM) (link to Docs) Search time: Exploratory:
|rex
|regex
Reformat
|eval
| eval formatted_timestamp=strftime(strptime(timestamp_field,"%Y-%m-%d %H:%M:%S"),"%m/%d/%Y")
... View more