Hello folks,  thanks for all of the feedback!!  When I tried the offered suggestion, I got results that included Started and Success, but I still didn't get results from Blocked.  index=security action IN ("Blocked", "Started", "Success") Splunk for Unix and Linux add-on will not load. I get an error stating the system it is trying to load does not run on either of the OS's.  It makes sense that I don't have the proper Add-on loaded but I am unable to figure which it is. I appreciate all of your help, folks. I am trying to learn this tool and am in training. This is not a job related query. I do not want to waste your time. Thanks again!   ... View more

Hello GCusello, yes I clicked on the word(s) "Blocked" and "Started" in the "Action" field window.  When I use the query index=security action="*" all three actions: Blocked, Started and  Success appear as shown in my original question. If I click on "Success" all of my events are returned, when I click on the other two, my results are "No results found".  I went down the list of Interesting Fields and tried all of the fields labeled with an   (not sure how to type that one) instead of an octothorp (#) and every one of them worked properly.  When I say I tried, I mean I opened the Interesting Fields and clicked on the desired selection, which alters the search criteria, the same way I have done with Blocked and Started.  I do not know how the categories get created in the Interesting Fields but it appears there is something wrong with Blocked and Started. ... View more

Hello, pardon my lack of proper vocab.  I hope I responded properly to your request for additional info. These are just the first two events from the data (.txt) file.   Thu Mar 31 2021 00:15:02 www1 sshd[4747]: Failed password for invalid user jabber from 118.142.68.222 port 3187 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[4111]: Failed password for invalid user db2 from 118.142.68.222 port 4150 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[5359]: Failed password for invalid user pmuser from 118.142.68.222 port 3356 ssh2 Thu Mar 31 2021 00:15:02 www1 su: pam_unix(su:session): session opened for user root by djohnson(uid=0) Thu Mar 31 2021 00:15:02 www1 sshd[2660]: Failed password for invalid user irc from 118.142.68.222 port 4343 ssh2   ... View more

Hello, pardon my lack of proper vocab.  Yes, for the second search I opened the "action" field in "Interesting Fields" and then clicked on the desired query (blocked, started, and success). The only one that produces found events is success.  Below please find a sample of the practice data used: Thu Mar 31 2021 00:15:02 www1 sshd[4747]: Failed password for invalid user jabber from 118.142.68.222 port 3187 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[4111]: Failed password for invalid user db2 from 118.142.68.222 port 4150 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[5359]: Failed password for invalid user pmuser from 118.142.68.222 port 3356 ssh2 ... View more

Hello, pardon my lack of proper vocab.  For the second search, I opened the "action" field in "Interesting Fields" and then clicked on the desired query (blocked, started, and success). The only one that produces found events is success.  Below please find a sample of the practice data used: Thu Mar 31 2021 00:15:02 www1 sshd[4747]: Failed password for invalid user jabber from 118.142.68.222 port 3187 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[4111]: Failed password for invalid user db2 from 118.142.68.222 port 4150 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[5359]: Failed password for invalid user pmuser from 118.142.68.222 port 3356 ssh2 Thu Mar 31 2021 00:15:02 www1 su: pam_unix(su:session): session opened for user root by djohnson(uid=0) Thu Mar 31 2021 00:15:02 www1 sshd[2660]: Failed password for invalid user irc from 118.142.68.222 port 4343 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[1705]: Failed password for happy from 118.142.68.222 port 4174 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[1292]: Failed password for nobody from 118.142.68.222 port 1654 ssh2 ... View more

Hello, pardon my lack of proper vocab.  For the second search, I opened the "action" field in "Interesting Fields" and then clicked on the desired query (blocked, started, and success). The only one that produces found events is success.  Below please find a sample of the practice data used: Thu Mar 31 2021 00:15:02 www1 sshd[4747]: Failed password for invalid user jabber from 118.142.68.222 port 3187 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[4111]: Failed password for invalid user db2 from 118.142.68.222 port 4150 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[5359]: Failed password for invalid user pmuser from 118.142.68.222 port 3356 ssh2 Thu Mar 31 2021 00:15:02 www1 su: pam_unix(su:session): session opened for user root by djohnson(uid=0) Thu Mar 31 2021 00:15:02 www1 sshd[2660]: Failed password for invalid user irc from 118.142.68.222 port 4343 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[1705]: Failed password for happy from 118.142.68.222 port 4174 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[1292]: Failed password for nobody from 118.142.68.222 port 1654 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[1560]: Failed password for invalid user local from 118.142.68.222 port 4616 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[59414]: Accepted password for myuan from 10.1.10.172 port 1569 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[1876]: Failed password for invalid user db2 from 118.142.68.222 port 1151 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[3310]: Failed password for apache from 118.142.68.222 port 4343 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[2149]: Failed password for nobody from 118.142.68.222 port 1527 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[2766]: Failed password for invalid user guest from 118.142.68.222 port 2581 ssh2 Thu Mar 31 2021 00:15:02 www1 sshd[3118]: pam_unix(sshd:session): session opened for user djohnson by (uid=0) ... View more

Hello, I have this instance on my personal computer and am a little confused about how to protect myself. I do not know which (or how to determine) allowedDomainList I should use. Where do I find the necessary information to fill that field in? Sorry, still a beginner..    ... View more