About b17gunnr

b17gunnr

Monitoring the file does not meet the fundamental requirement of the ask. This is part of an attempt to automate the collection of compliance and audit evidence via Splunk. In this case, the regulatory body requires copies of this file from the source system. If we are able to automate the collection process through Splunk I'd be able to schedule a report for them and free up an Engineer's time.

b17gunnr

Hello Friends, I have what might be considered a strange request. I have a static unbound.conf file living on a dns server whose contents I'm being asked to ingest into Splunk for a variety of reasons. The UF does have a functioning UF installed on it and I am receiving events from a handful of monitored files without issue. The question I have is would this work as scripted below? Naturally it isn't right now so here I am. Any thoughts? Thank you. --------------------------------------------------------------------------------- Add to /opt/splunkforwarder/etc/system/local/inputs.conf: [script:///opt/splunkforwarder/etc/system/local/bin/read_unbound_conf.sh] sourcetype = secure_name_resolution index = dns interval = 86400 disabled = 0 Add to /opt/splunkforwarder/etc/system/local/props.conf: [secure_name_resolution] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?=server=) TRUNCATE = 1000000 DATETIME_CONFIG = CURRENT Create /opt/splunkforwarder/etc/system/local/bin/read_unbound_conf.sh: bash #!/bin/bash echo "server=$(hostname)" cat /etc/unbound/unbound.conf chmod +x /opt/splunkforwarder/etc/system/local/bin/read_unbound_conf.sh Restart UF

b17gunnr · ‎02-09-2026

Excellent starting point, very much appreciate the suggestion and the level of detail explaining the thought process.

b17gunnr · ‎02-04-2026

This solution is outside my current budgeting options.

b17gunnr · ‎02-04-2026

Unfortunately, this solution exceeds my budget.

b17gunnr · ‎02-03-2026

Hello folks, I have a compliance control requirement to alert when there is a log ingestion failure to Splunk. The desire is to focus at the sourcetype level as opposed to the host level (too many false positives) or index level (loses granularity as sourcetypes increase). The keys to the requirement are to dynamically expand as new sourcetypes come online and Splunk's results must consider the frequency of events on a per sourcetype basis. For example, a generic 4-hour window wouldn't suffice for a sourcetype getting multiple events every second, nor would it be properly handle a sourcetype that receives events once or twice per day. I've tried the Meta Woot app and while beneficial for other issues, it does not address the control requirements. Has anyone developed a query with reasonable performance times, or found another app to handle compliance logging failures that considers the variance in event frequency and not an absolute? Thanks!

b17gunnr · ‎12-24-2025

Hello folks, I am trying to customize the drilldown options for panels created in Dashboard Studio. My panel works and renders a table with columns for items such as FQDN, hostname, IP addresses, etc. What I would like to do is be able to click on the FQDN and link to a custom URL but if I click on the Hostname link to a automatic or customized search. Is it possible to tell Splunk that, within the same panel, if I click on 'X' take me here, but if I click on 'Y' take me there? Thank you for the help.

b17gunnr · ‎11-04-2025

The problem has been resolved with the following stanza in /opt/splunk/etc/system/local/props.conf [audit:log] TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%H:%M:%S%:z MAX_TIMESTAMP_LOOKAHEAD = 30 SHOULD_LINEMERGE = false # TZ = UTC MAX_DIFF_SECS_HENCE = 86400 DATETIME_CONFIG = CURRENT Some additional research. Prior to adding the bottom two lines to the stanza, I verified the VM is aware of the correct date and time, that it was distinguishing between local and UTC properly (note that the change from EDT to EST moved the offset from 4 to 5 hours), and that we were sync'd to NTP. splunk@idx1:~$ date Tue Nov 4 11:32:35 AM EST 2025 splunk@idx1:~$ timedatectl Local time: Tue 2025-11-04 11:32:47 EST Universal time: Tue 2025-11-04 16:32:47 UTC RTC time: Tue 2025-11-04 16:32:47 Time zone: America/New_York (EST, -0500) System clock synchronized: yes NTP service: active RTC in local TZ: no splunk@idx1:~$ timedatectl show | grep NTPSynchronized NTPSynchronized=yes Then verified that there was nothing abnormal on the search heads which could be taking priority of the changes made to the indexer. splunk@srch01:~$ /opt/splunk/bin/splunk btool props list audit:log --debug splunk@srch01:~$ splunk@srch02:~$ /opt/splunk/bin/splunk btool props list audit:log --debug splunk@srch03:~@ splunk@srch03:~$ /opt/splunk/bin/splunk btool props list audit:log --debug splunk@srch03:~$

b17gunnr · ‎11-03-2025

I believe I have the stanza in the correct location, here's a btool output and the sourcetype in question is only in one of two places. splunk@splk-indexer01:~$ /opt/splunk/bin/splunk btool props list audit:log --debug /opt/splunk/etc/system/local/props.conf [audit:log] /opt/splunk/etc/system/default/props.conf ADD_EXTRA_TIME_FIELDS = True /opt/splunk/etc/system/default/props.conf ANNOTATE_PUNCT = True /opt/splunk/etc/system/default/props.conf AUTO_KV_JSON = true /opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE = /opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE_DATE = True /opt/splunk/etc/system/default/props.conf CHARSET = UTF-8 /opt/splunk/etc/system/default/props.conf DATETIME_CONFIG = /etc/datetime.xml /opt/splunk/etc/system/default/props.conf DEPTH_LIMIT = 1000 /opt/splunk/etc/system/default/props.conf DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = false /opt/splunk/etc/system/default/props.conf HEADER_MODE = /opt/splunk/etc/system/default/props.conf LB_CHUNK_BREAKER_TRUNCATE = 2000000 /opt/splunk/etc/system/default/props.conf LEARN_MODEL = true /opt/splunk/etc/system/default/props.conf LEARN_SOURCETYPE = true /opt/splunk/etc/system/default/props.conf LINE_BREAKER_LOOKBEHIND = 100 /opt/splunk/etc/system/default/props.conf MATCH_LIMIT = 100000 /opt/splunk/etc/system/default/props.conf MAX_DAYS_AGO = 2000 /opt/splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2 /opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_AGO = 3600 /opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_HENCE = 604800 /opt/splunk/etc/system/default/props.conf MAX_EVENTS = 256 /opt/splunk/etc/system/default/props.conf MAX_EXPECTED_EVENT_LINES = 7 /opt/splunk/etc/system/local/props.conf MAX_TIMESTAMP_LOOKAHEAD = 30 /opt/splunk/etc/system/default/props.conf MUST_BREAK_AFTER = /opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_AFTER = /opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_BEFORE = /opt/splunk/etc/system/default/props.conf SEGMENTATION = indexing /opt/splunk/etc/system/default/props.conf SEGMENTATION-all = full /opt/splunk/etc/system/default/props.conf SEGMENTATION-inner = inner /opt/splunk/etc/system/default/props.conf SEGMENTATION-outer = outer /opt/splunk/etc/system/default/props.conf SEGMENTATION-raw = none /opt/splunk/etc/system/default/props.conf SEGMENTATION-standard = standard /opt/splunk/etc/system/default/props.conf SHOULD_LINEMERGE = True /opt/splunk/etc/system/local/props.conf TIME_FORMAT = %Y-%m-%dT%H:%M:%S%:z /opt/splunk/etc/system/local/props.conf TIME_PREFIX = ^ /opt/splunk/etc/system/default/props.conf TRANSFORMS = /opt/splunk/etc/system/local/props.conf TRUNCATE = 75000 /opt/splunk/etc/system/default/props.conf detect_trailing_nulls = false /opt/splunk/etc/system/default/props.conf maxDist = 100 /opt/splunk/etc/system/default/props.conf priority = /opt/splunk/etc/system/default/props.conf sourcetype = /opt/splunk/etc/system/default/props.conf termFrequencyWeightedDist = false /opt/splunk/etc/system/default/props.conf unarchive_cmd_start_mode = shell

b17gunnr · ‎11-03-2025

The indexer is not recognizing the then 4 hour offset from UTC; I say then because we flipped form EDT to EST over the weekend. So, when an event is received by the indexer at 08:00:00 EDT, the 12:00:00UTC time is being recognized and Splunk holds that event until noon EDT.

b17gunnr · ‎11-03-2025

Hello, It is a straight-forward solution. I have a UF that is reading an internal file and forwarding contents to the Indexer. The Indexer is receiving those updates in UTC minus US eastern time offset (now 5 hours) but is not adjusting as per changes made to the Indexer's props.conf. All suggestions were tried and restarts took place after each change. No change in status...

b17gunnr · ‎10-30-2025

Struck out here as well.

b17gunnr · ‎10-29-2025

Hello, I've tried the suggested TIME-FORMAT with and without TZ = UTC and it's still reading 4 hours into the future.

b17gunnr · ‎10-29-2025

Hello, I'm working on the indexer's props.conf. I've tried it with and without TZ = UTC and it's still reading 4 hours into the future.

b17gunnr · ‎10-29-2025

Hello folks, I have a universal forwarder sending Splunk logs which follow the format below. Unfortunately Splunk is not recognizing the UTC offset and is declaring them as being the future. I have edited my /opt/splunk/etc/system/local/props.conf file with the following stanza and restarted but there is no change and Splunk still wants them in UTC. Can anyone point me at what I'm doing wrong? Thank you. Log Entry 2025-10-29T14:55:17-04:00 cis-pfmc SF-IMS[5970]: [meta sequenceId="5415975"]CSMEventServer[11588]: *** Got a message: ------------------------------------ Proposed /opt/splunk/etc/system/local/props.conf stanza [audit:log] TIME_FORMAT = %Y-%m-%dT%H:%M:%S%z TZ = UTC ------------------------------------ Additional Info index=firewall_audit sourcetype=audit:log source=/var/log/firewall.log

b17gunnr · ‎09-24-2025

Hello folks, I'm struggling with something that should be very basic. I have two queries to track skipped scheduled searches, the first counts the number of times a search has been skipped and the second counts how many times my individual SHC members have skipped a search. What I would like to be able to do is render my first query as a column chart and then overlay the second as a line chart. Any help would be appreciated. Thank you. index=_internal sourcetype=scheduler status="skipped" | timechart count BY savedsearch_name useother=f usenull=f limit=0 index=_internal sourcetype=scheduler status="skipped" | timechart count BY host useother=f usenull=f limit=0

b17gunnr · ‎08-27-2025

There is an automation that is supposed to only grab CSV files and move them into another directory. Looks like it needs to be tweaked because it is also grabbing text files. Appreciate the help.

b17gunnr · ‎08-26-2025

Hello Friends, I am consistently receiving alerts that the README file found in the path /opt/splunk/etc/system/lookups/ within my SHC is missing. When hit that directory I can confirm that it is gone, and while I believe it to be a default file, when I take a copy of it from another instance that has no issue, the file is removed after 5 or so minutes. I have confirmed that file owner and group are splunk and while the file is present, I can cat it without issue. Would anyone have seen this themselves or have any ideas on how to remediate it? Thank you.

b17gunnr · ‎08-25-2025

Hello friends, Splunk is cranky with errors stating: Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (40) characters of event. Defaulting to timestamp of previous event. This is related to my Cisco estreamer ingest and there are no timestamps in any of the events. Is there a way to tell the Indexer that there are no timestamps, that it should not use the lookahead, and configure the index time as the event time for the specific index and sourcetype? Thank you.

b17gunnr · ‎06-13-2025

Hello folks, I'm fighting some events in the future and am having some trouble breaking the code for parsing an event. I have the following event (with a little redaction) and have tried some flavors of the the stanza below primarily messing with the TIME_PREFIX to no avail. For every change I make (and a Splunk restart after the fact), Splunk just wants the event in UTC and it is not considering my timezone offset. Does anyone have any suggestions or thoughts at to why I cannot get Splunk to recognize that time properly? Thank you. {"id": 141865, "summary": "User's password changed", "remoteAddress": "X.X.X.X", "created": "2025-06-12T14:13:19.323+0000", "category": "user management", "eventSource": "", "objectItem": {"id": "lots_of_jibberish", "name": "lots_of_jibberish", "typeName": "USER", "parentId": "10000", "parentName": "com.AAA.BBB.CCC.DDD"}, "associatedItems": [{"id": "lots_of_jibberish", "name": "lots_of_jibberish", "typeName": "USER", "parentId": "10000", "parentName": "com.AAA.BBB.CCC.DDD"}]} [my_stanza] TIME_PREFIX = "created": " TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ TZ = UTC

b17gunnr · ‎04-11-2025

Unfortunately neither of these were the cause. In the end I believe we're going to set up an intermediate VM with a UF to catch the logs from the Firepowers on udp514. Clunky but it appears to be the only option. I appreciate the help.

b17gunnr · ‎04-07-2025

Hello folks, My organization is struggling with ingesting the Cisco Firepower audit (sys)logs into Splunk, we've been able to successfully ingest all the other sources. With the Firepowers only offering up 514udp which is unavailable according to Splunk, or a HEC configuration without tokens so Splunk is (would?) drop the events our option appear limited. Has anyone else come across this issue and solved it?

b17gunnr · ‎03-25-2025

This was it. Thank you for the assist.

b17gunnr · ‎03-24-2025

Hello folks, I have a series of event results which take the format as shown below: appDisplayName: foo appId: foo0 appliedConditionalAccessPolicies: [ [-] { [-] displayName: All Users Require MFA All Apps enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: foo1 result: success } { [-] displayName: macOS Conditional Access Policy enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: foo2 result: success } { [-] displayName: Global-Restrict enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: foo3 result: notApplied } { [-] displayName: All_user_risk_policy enforcedGrantControls: [ [+] ] enforcedSessionControls: [ [+] ] id: foo4 result: notApplied Is there a way to cycle through the specific event to extract and maintain the correlation of field:value and then repeat for one or more event blocks? Effectively it would look like this: displayName: All Users Require MFA All Apps - id: foo1 - result: success displayName: macOS Conditional Access Policy - id: foo2 - result: success displayName: Global-Restrict - id: foo3 - result: notApplied displayName: All_user_risk_policy - id: foo4 - result: notApplied Thank you to all.

b17gunnr · ‎03-21-2025

Making this adjustment was just what I needed. I noticed that as I started playing with fields I could change the results, but I was focusing on the secondary query as opposed to the base query. Thank you all for the help and advice.

Posts	27
Solutions	2
Karma Given	18
Karma Received	2
Member Since	‎03-21-2025

Online Status	Offline
Date Last Visited	3 weeks ago

Static File Ingestion to Splunk

Log Ingestion Failure by Sourcetype

Customizable Dashboard Studio Drill Down Interacti...

Events in the Future from a UF

Chart Overlay Help

/opt/splunk/etc/system/lookups/README Keeps Disapp...

Splunk Cisco encore Events with no Timestamp

TIME_PREFIX Challenge

Splunk and Cisco Firepower Audit Logs

Multivalue field extraction from nested field

Re: Static File Ingestion to Splunk

Static File Ingestion to Splunk

Re: Log Ingestion Failure by Sourcetype

Re: Log Ingestion Failure by Sourcetype

Re: Log Ingestion Failure by Sourcetype

Log Ingestion Failure by Sourcetype

Customizable Dashboard Studio Drill Down Interacti...

Re: Events in the Future from a UF

Re: Events in the Future from a UF

Re: Events in the Future from a UF

Re: Events in the Future from a UF

Re: Events in the Future from a UF

Re: Events in the Future from a UF

Re: Events in the Future from a UF

Events in the Future from a UF

Chart Overlay Help

Re: /opt/splunk/etc/system/lookups/README Keeps Di...

/opt/splunk/etc/system/lookups/README Keeps Disapp...

Splunk Cisco encore Events with no Timestamp

TIME_PREFIX Challenge

Re: Splunk and Cisco Firepower Audit Logs

Splunk and Cisco Firepower Audit Logs

Re: Multivalue field extraction from nested field

Multivalue field extraction from nested field

Re: Base search not returning results

Join the Conversation