From the below Log: aoauwersdfx01a-mgt.example.com NewDecom: Info: 164807335647.901 0 10.200.111.06 NONE/504 0 GET http://wpad.example.com/wpad.dat - NONE/wpad.example.com Need to extract the fields: Field 1: result=NON/504 change to status=504 Field 2: url=http://wpad.example.com/wpad.dat change to url=wpad.example.com Need the regular expression for this.   ... View more

Hi please help here we are using below base search and we need to see all ssl certificates with days left in EST. index=ssl_certs |rex field=_raw "[^'\n]*'expires=\"(?<expires>[^\\\'\"]+)"| stats c by host expires cert | eval time = strftime( strptime( expires , "%b %d %H:%M:%S %Y %Z" ), "%Y/%m/%d %H:%M:%S %Z") need exact query for this we tried a lot actually. we are using ssl_checker app for this. ... View more

Hi, From the below events i need to extract the field called "Event_Name" which is associated with "BeyondTrust_PBUL_ACCEPT_Event" from below 3 events Desired output: Event_Name(filed name)=BeyondTrust_PBUL_ACCEPT_Event(field value) Example Event 1: <86>Dec 22 ddppvc0729 pbmerd2.1.0-12: BeyondTrust_PBUL_ACCEPT_Event: Time_Zone='IST'; Request_Date='2021/1/27'; Request_Time='2:2:51'; Request_End_Date='2021/1/27'; Request_End_Time='22:1:51';Submit_User='spnt'; Submit_Host='wcpl.com';  Example Event 2: <83>Dec 22 ddpc0729 pbmerd21.1.0-12: [2658] 5105.1 failed to get ACK packet during a CMD_SWAPTTY_ONE_LINE sequence - read failure in receive acknowledgement Example Event 3: <38>Dec 22 ddppvc0729 root[25132]: [ID 7011 auth.info] CEF:0|BeyondTrust|PowerBroker|1.1.0-12|7011|PBEvent=Accept|4|act=Accept end=Dec 1 2021 1:11:40 shost=dc8 dvchost=dc8 suser=t8adsfk duser=root filePath=/opt/ cs1Label=Ticket cs1=Not_Applicable deviceExternalId=0a2adfersds9 fname=./SSB_Refresh_Pbrun_Local_Policy_Files.sh   What i tried from regex extraction: Input: (?<Event_Name>\w{10}[a-zA-Z]+_[a-zA-Z]+_[a-zA-Z]+_[a-zA-Z]+) Output: matching 2 places from above 3 events       ... View more

HI, I am having some logs comes with XML format for Privilaged Access Manager, i need to extract the fields by default like this Example: fields <level></level> <k>=<v> commandinitiatio =USER <success>false</success> success=false jan 9 09:04:56 1.30.124.24 1 2012-01-09T14:04:56+00:00 yahoota.com pam - metric DETAIL <Metric><type>getAccount</type><level>1</level><description><hashmap><k>commandInitiator</k><v>USER</v><k>commandName</k><v>getAccount</v><k>clientType</k><v>java</v><k>osarch</k><v>amd64</v><k>targetServerAlias</k><v>USR_LOCL_MARKETING_INTELLIGENCE_BATCH</v><k>nodeid</k><v>&lt;?xml version="1.0" encoding="utf-8" ?&gt;&lt;nodeid&gt;&lt;macaddr&gt;&lt;/macaddr&gt;&lt;macaddr&gt:E0&lt;/macaddr&gt;&lt;macaddr&gt;A0:C:E0&lt;/macaddr&gt;&lt;macaddr&gt;:E0&lt;/macaddr&gt;&lt;macaddr&gt;1:E1&lt;/macaddr&gt;&lt;macaddr&gt;1:E3&lt;/macaddr&gt;&lt;macaddr&gt;:E2&lt;/macaddr&gt;&lt;machineid&gt;1E3&lt;/machineid&gt;&lt;applicationtype&gt;cspm&lt;/applicationtype&gt;&lt;/nodeid&gt;</v><k>enablefips</k><v>true</v><k>executionUID</k><v>bibatusr</v><k>version</k><v>4.5.3</v><k>scriptStat</k><v>/opt/ibm/bigintegrate/tools</v><k>scriptName</k><v>/home/infra/bibatusr/run_ds_job.sh</v><k>osversion</k><v>3.10.0-1127.el7.x86_64</v><k>digestLoginDate</k><k>applicationtype</k><v>cspm</v><k>getXMLIndicator</k><v>false</v></hashmap></description><errorCode>405</errorCode><userID>client</userID><success>false</success><originatingIPAddress>10.111.211.50</originatingIPAddress><originatingHostName>yahoota.com</originatingHostName><extensionType></extensionType></Metric>   I need this as default when these type logs integrated to splunk its automatically extract fields when we set up in props.conf and trasforms.conf so here what is the stanzas we have to write under this. ... View more

Hi, We are having bunch of HFs in our environment from HFs we have confusion from which HF is getting the data, so to find easily we have to right stanza in props.conf in defaults/local. So based on this what is the stanza i can right Example fields: splunk_HF                                 indextime   ... View more

Hello Team, In my org they installed the below certs in particular role, need to know by seeing below table which category it may comes to. Can anyone please explain how this. We are checking this link but not understand. About securing Splunk Enterprise with SSL - Splunk Documentation Role Cert Remarks Internal Heavy Forwarders /opt/splunk/etc/auth/myServerCertificate.pem /opt/splunk/etc/auth/rootCA.pem   SH cluster   Cluster Master   DMZ HF   DS   ES SH Deployer   HF Cluster   IDX Cluster   Monitoring Console   ES SH Cluster /opt/splunk/etc/auth/webcerts/mySplunkWebCertificate.pem   /opt/splunk/etc/auth/myServerCertificate.pem   /opt/splunk/etc/auth/rootCA.pem   ... View more