Hi, I want to change the Alert condition of the correlation rules in ES APP. I am using ES App v 2.4.1 and Splunk v 5.0.5. If I open the correlation rule through Enterprise Security>>Configure>>Correlation Searches, I do not get many options like Alert condition, Expiration Time. However, these fileds are accesible if I open the same correaltion rule from core splunk>>Manager>>Searches and Reports. But, when I make any changes to these paramters through core splunk manager, the changes do not reflect even though it shows me "the search has been updated" message. I want the alert condition to be in accordance with the "No of events" option. Also I want to remove throttling since I have scheduled all the correlation rules in the ES APP and hence throttling isn't required. I am not sure how this can be done. Please help and correct me if I am wrong in my understanding of this. Thanks in anticipation. ... View more

Hi, I have a search which displays the last login made by a user on several hosts. I want to generate a report on this search but don't want to use count as the parameter. I am able to create the report by using count but it is meaningless to include count here. I have tried | xyseries User Host LastLoginTime but it also does not give me the desired output in the form of a graph. I want to display the User,Host and LastLogintime in the report. How can I make the report meaningful without using count? I want the report to be a graph. Please suggest. ... View more

Hi, I have Host Firewall Logs coming in a text file. The data in the text file is separated by spaces and is inconsistent as for some rows there are say 8 columns, in some there are fewer and in some greater than 8 columns. I want to perform filed extraction on this data. How can this be achieved? I am familiar with csv field extraction but there the data is not inconsistent as is the case with this text file. I am using Splunk v5.0.5. Please help. Its quite urgent. Any help would be really appreciated. ... View more

Hi, I am facing problems while editing and re-enforcing the indexes.conf from master. I edited the indexes.conf in Splunk\etc\master-apps\local and applied it to the peers by using the cluster-bundle command. However, on doing so the default and local folders under slave-apps on peers got deleted. I want to know the correct way of doing this, as in how and in which sequence to stop the master, peers, search head, in order to apply the edited indexes.conf successfully. I am using all Splunk instances of v5.0.5 Please respond. ... View more

Hi, I have set up a clustered environment for testing purpose. The cluster comprises of 2 peers, a search head, a master node and a universal forwarder. All components are Splunk v5.0.5. I have set both the search factor and replication factor 2. I want to archive the data on each of the peers. When I push the common indexes.conf from the master node, I get indexing errors and the configuration does not work. If, I need to archive the data from both the peers, do I need to have a separate indexes.conf for each peer? Thanks in anticipation. Please respond. ... View more

Hi, I am using a script for archiving logs from colddb to a desired location. I have used the coldToFrozenExample.py script and basically just changed the archived location. The script works fine. However, since I intend to sign the bucket before archiving, I used the signtool -s ARCHIVE_DIR line in the script just before the bucket was to be copied to the location(as stated in the documentation). But, on doing so, the script doesnt work. Could it be the placement of signtool command? If so, please specify the exact location, as to where it should be placed. I am not familiar with python and hence, not able to spot the location. Any help would be appreciated. Thanks in advance. ... View more

Hi, I wanted to know that, if splunk Universal forwarder service is stopped for some time and then started again. When it starts forwarding the data again, does it forward the data from the time when it was stopped? More specifically, how many days' data would the universal forwarder forward,once its service is started again,if the service was stopped for a longer duration, say 10 days or so? ... View more

Hi, I am not able to configure the ssl connections between the forwarder and indexer. The splunkd logs on both the indexer and forwarder are not the same as cited in the documentation. Here is what I get on Indexer in splunkd.log: Date Time +1100 INFO TcpInputConfig - IPv4 port 9997 is reserved for splunk 2 splunk Date Time +1100 INFO TcpInputConfig - IPv4 port 9997 is not compressed Date Time +1100 INFO TcpInputConfig - IPv4 port 9997 is reserved for splunk 2 splunk (SSL) Date Time +1100 INFO TcpInputConfig - IPv4 port 9997 is compressed Date Time +1100 INFO TcpInputProc - Registering metrics callback for: tcpin_connections After this, I do not get any other message as mentioned in the documentation. On Forwarder, I get the following in splunkd.log: Date Time +1100 INFO TcpOutputProc - found Whitelist forwardedindex.0.whitelist , RE : forwardedindex.0.whitelist Date Time +1100 INFO TcpOutputProc - found Blacklist forwardedindex.1.blacklist , RE : forwardedindex.1.blacklist Date Time +1100 INFO TcpOutputProc - found Whitelist forwardedindex.2.whitelist , RE : forwardedindex.2.whitelist Date Time +1100 INFO TcpOutputProc - tcpout group splunkssl using Auto load balanced forwarding Date Time +1100 INFO TcpOutputProc - Group splunkssl initialized with maxQueueSize=512000 in bytes. Date Time +1100 WARN TcpOutputProc - Connected to idx= :9997. Not using ACK. Date Time +1100 WARN TcpOutputProc - Connected to idx= :9997. Not using ACK. Date Time +1100 INFO TcpOutputProc - Connection to :9997 closed. Connection closed For enabling SSL connection between a forwarder and an indexer, I performed the following configurations: On Indexer(Windows) I added the following stanzas in $SPLUNK_HOME\etc\system\local\inputs.conf [splunktcp-ssl:9997] compressed = true [SSL] rootCA = $SPLUNK_HOME\etc\auth\cacert.pem serverCert = $SPLUNK_HOME\etc\auth\server.pem password = password On Forwarder(Windows) I added the following stanzas in $SPLUNK_HOME\etc\system\local\outputs.conf [tcpout] defaultGroup = splunkssl [tcpout:splunkssl] compressed = true server = :9997 sslCertPath = $SPLUNK_HOME\etc\auth\server.pem sslPassword = password sslRootCAPath = $SPLUNK_HOME\etc\auth\cacert.pem sslVerifyServerCert = false I checked if there were 2 inputs.conf stanzas using port 9997. There were no 2 stanzas using port 9997 but I still changed the port to 9996 for ssl connection. Despite changing the port, I don't get the output in splunkd.log as mentioned in the splunk documentation. However, when I checked the metrics.log file on Indexer, I get "ssl=true". Does this mean that ssl is enabled, even though the splunkd logs are not as desired? Please help. ... View more