The goal here is that windows logs that are moved off a system can be added to a NAS location that i can mount to the splunk instance. With this then i can ingest logs are normal maintaining the same source as windows:security. However this is stated to be an API call so i am not sure if i apply the following stanza would work: [WinEventLog://Security] disabled = 0 index = test01   Some other details is that the logs are coming off a windows system that is isolated not connected to splunk. Splunk says you can't monitor .evtx files with a monitor stanza. The nas location is linux based so the logs would be dropped in a directory such as /Nas/Windows/Hostname. Any best practices to make this work? ... View more

I am current denying chrome and edge processes from being indexed with the following regex   blacklist7 = EventCode="4673" Message="Audit\sFailure[\W\w]+Process\sName:[^\n]+(chrome.exe|msedge.exe)"    This works on majority of the forwarders. However some stragglers still send these events in event though they have the updated inputs deploy on their systems. My work around is to nullqueue the events in transforms.conf in the /etc/system/local directory. I believe this should be working at the forwarder level. Any ideas as to why this is happening.    Some perspective is i have 400 windows machines and only 5 of the systems still send in the events even after a deploy server reload.   ... View more

I am trying to route my windows security logs to another specified index but it has to meet certain criteria. EventCode has to be 4688 and the Token Elevation Level equals either %%1936, %%1938, TokenElevationTypeDefault, TokenElevationTypeLimited. So far i have written these regular expressions 1. REGEX = ((?s).*EventCode=4688*.)((?si).*(%%1936|TokenElevationTypeDefault|TokenElevationTypeLimited)*.) 2. REGEX = EventCode=4688.*TokenElevationType=(%%1936|%%1938|TokenElevationTypeDefault|TokenElevationTypeLimited) When using 1, All eventcodes 4688 come to the specified index when i only wanted 1936 and 1938. I wanted to leave the %%1937 token in its original index. When using 2, no data at all comes to the index even though its seems to be a much simpler regex. What am i missing to ensure 4688 is properly filter using transforms and props? ... View more

I have two of the exact same searches and one works within the search app but not this custom internal app that package the savedsearch.   The search works for both apps until the where command is introduced.            | eval delta_time = delete_time - create_time, hours=round(delta_time/3600,2)\ | where delta_time < (48 * 3600)\         This returns results in the search app but not in the app that houses this alert. The app is shared globally and all the objects within it. I also have the admin role with no restricted indexes or data.   ... View more

Missing indexes Any one have a way to investigate what causes indexes to suddenly disappear? Running a btool and indexes list… my primary indexes with all my security logs are just not there. I also have a NFS mount for archival and the logs are missing from there too. Going to the /opt/splunk/var/lib/splunk directory I see the last hot bucket was collected around 9am. I am trying to parse through whatever logs to find out what happened and how to recover. ... View more

I am trying to extract some field values that comes in the following format <date>00-mon-year</date> <DisplayName>example</DisplayName> <Hostname>example</Hostname>   When using the spl rex function i am able to extract the fields using  rex field=_raw "Hostname>(?<hostname>.*)<".   Then i have tried to use both a inline regex function in props with the same regex (without quotes) and it does not work. I have also used a transforms.conf with the stanza as follows [hostname] FORMAT = Hostname::$1 REGEX = Hostname>(?<hostname>(.*?))</Hostname   then in the props REPORT -Hostname = hostname   and this does not work.   However, i have another source that pulls the same type of logs and i am able to use inline regex in spl format just fine with no issues. This issue is only specific to this source which i have as [source::/opt/*]   Any ideas on this fix? ... View more

I am having an issue with the initial configuration to generate LDAP queries. In the GUI i have my settings as such  Anyone that is a splunk admin have any idea on how to make the ldap queries work? I have tried the configurating via the add on for active directory and my ldap.conf file is set as [ADS] alternatedomain = abc.bcd.com basedn = dc=ads,dc=abc,dc=com binddn = CN=SplunkUser,OU=Service Accounts,OU=User Accounts,DC=ads,DC=abc,DC=com port = 3269 server = x.x.x.x ssl = 1 however, with the test connection, it does not work.  ... View more