Upgraded my HF and Deployment servers from 9.0.4 to 9.2.2.  These are Windows servers.  Then I received KVStore/MongoDB failure messages.  I've tried the KVStore migration steps.  I've tried removing the .lock files from the mongo folder.  I am trying to get the MongoDB updated/upgraded to the latest version so the KVStore will stop complaining.  Any help to clear this up would be greatly appreciated.   ... View more

Receiving below errors when starting Splunk. Windows Server 2012R2 Splunk 7.3.3 Checking configuration... Error while parsing 'C:\Program Files\Splunk\e tc\datetime.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\searchLanguage.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\exec\config.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\fschangemanager\c onfig.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\RemoteQueue\confi g.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\stashparsing\conf ig.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\structuredparsing \config.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\tailfile\config.x ml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\TCP\config.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\UDP\config.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\wineventlog\confi g.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\input\winparsing\config .xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\internal\scheduler\conf ig.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\modules\parsing\config.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\myinstall\splunkd.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\system\default\data\ui\views\jo b_management.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\system\default\data\ui\views\_a dmin.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\system\static\cliDirectory.xml' : 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\system\static\cliMaster.xml': 'module' object has no attribute 'parse' Error while parsing 'C:\Program Files\Splunk\etc\system\static\splunkrc_cmds.xml ': 'module' object has no attribute 'parse' There were problems with the configuration files. Would you like to ignore these errors? [y/n]:y ... View more

Scenario: two different source types being sent to UF (snort and firewall) from the same IP/source. format of data is JSON (see below example) { "client": {"ip": "...",... ... "type": "snort" } { "fw": {"iptables": "...",... "client": {"ip": "...",... ... "type": "firewall" }{ "client": {"ip": "...",... ... "type": "snort" } { "fw": {"iptables": "...",... "client": {"ip": "...",... ... "type": "firewall" } I've tried using regexes like below to separate them. props.conf [udp:514] TRANSFORMS-set_sourcetype = snort,firewall transforms.conf [snort] REGEX = ^(.*?type\"\:)(?P<type>("([^}]|"")*")) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::$type [firewall] REGEX = ^(.*?type\"\:)(?P<type>("([^}]|"")*")) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::$type Looking for the best method to assign the sourcetypes. I do not have control over the data structure or how it is sent to the UF. ... View more

Having issues with Splunk extracting the fields from Snort events being forwarded to Universal Forwarders. UF is configured to receive events on UDP 514 as soucetype=snort. The scenario is as follows: Snort sensor--(sends event UDP 514)-->Splunk UF---(sends event TCP 9997)-->Splunk Indexers Environment: Splunk v 7.3.1 Snort for Splunk is on the UF, SH, and Indexers. Raw event Sep 16 11:37:04 %REDACTED_IP% 2019-09-16T07:37:04.291385-04:00 SystemX ids_alerts - - [ids_alerts@52391.1 msg="ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 1" pad2="0" appid="" impact="0" blocked="0" vlan-id="0" event-id="210" priority="2" protocol="6" sensor-id="SystemX" source-ip="%REDACTED_IP%" mpls-label="0" dport-icode="22" impact-flag="0" sport-itype="54974" event-second="1568633823" generator-id="1" signature-id="2500000" classification="Misc Attack" destination-ip="%REDACTED_IP%" sensor-interface="WAN Ethernet Port" classification-id="30" event-microsecond="302356" signature-revision="5175" _id="4904" _timestamp="2019-09-16 07:37:04.224183" _source="SystemX"] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 1 Screenshot from Splunk of field extractions. Yes, verbose is set and app permissions are set to globally with all apps. What am I doing wrong? ... View more

Trying to figure out how to get a transaction search to show results where there are 5 or more failed logons (4625) and then a successful logon (4624). Have a transaction search that works, but all of the results are one failed logon followed by a successful logon. These are the typical fat-fingered the first time and then successfully logon scenarios. Want to see where there are more failed logon attempts and then the successful logon. Below is the base transaction search. Looked at the post -> https colon slash slash answers dot splunk dot com/answers/351046/how-do-i-edit-my-transaction-search-to-find-over-3 dot html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev , but that seems to only work if one EventCode is in the search. Thank you in advance for your assistance. index=wineventlog EventCode=4625 OR EventCode=4624 Account_Name!="*$" | transaction user, Workstation_Name maxspan=10m startswith=(action="failure") endswith=(action="success") ... View more

Recently installed the Splunk Add-on for Nessus and have it successfully pulling data from my scanner. It is only showing scan data for the current month though. Is there a way to have it pull data further back. Nessus version is 6.5.2 and Splunk version 6.2.0.237341. Thank you in advance for your time. ... View more