@bwooden the fired alerts REST endpoint works very well but how I can I restrict the time range? It doesn't respond to time range picker. ... View more

sure, it will replace "host" field base on regex, and how to keep hostname of forwarder to new field? ... View more

Here you go: ^([^\s]+\s+){6}(?P<src_ip>\d+\.\d+\.\d+\.\d+) ... View more

FWIW, names worked too... thanks! ... View more

I had almost the exact same problem with the same lookup tables in the errors. For me it was a Windows NTFS permissions issue on the server. I turned on enable inheritance (not sure why it wasn't on) and reset all permissions below that for the app. To clarify - this was on the splunk_app_windows_infrastructure folder in the Splunk/etc/apps folder. I also needed to the same for the Splunk_TA_windows Also it's possible that when installing the app the default lookup table files didn't all copy down, so re-download from the splunk site (extract it) and you can just compare what lookup files are in the default install and what made it into your folder. ... View more

Thanks. I ran into this when manually adding an app at the command line as well. I had to chown -R splunk:splunk on the new app ... View more

Here is some supplemental reading from documentation on various ways to convert field values. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Convert http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonEvalFunctions ... View more

since the first answer, SPLICE has been successfully tested with http://www.hailataxii.com feeds (-: ... View more

The timeout issue is a known problems with Splunk on Windows. Despite the error message, the setup routine ususally completes ... View more

ok sure.. will try.. Thanks a lot.. ... View more

It works great on the 6.5 release and up, and is built into Splunk now. Go to settings, How to set it up here: https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/ConfigureDuo ... View more

It's inside the Splunk_for_Activedirectory/appserver/addons directory ... View more

Yes. The assumption would be that Splunk will pick events up right as the file is updated, so index time will be roughly the same as file modification time. ... View more

Made it with a week to spare. 🙂 I just submitted the app. It seemed to work but the link isn't up yet . . . so I'm guessing someone needs to approve it? Anyway, here's the link: http://splunk-base.splunk.com/apps/TA-mandiant_ioc ... View more

I'm confused on something - is that one directory name? Couple things to check if so Make sure there are 2 colons " : " between monitor and the first forward slash. Put a backslash between the "C:" and "Program Its my experience that the path name is case sensitive so make sure spelling and case is correct Shouldn't need to end with a wild card even if you are getting sub directories IF each capitol letter is a directory name make sure you put backslashes as appropriate ... View more

I have tried with the following in the props.conf but still getting the same issue [bayer_glucofacts] BREAK_ONLY_BEFORE = ([\r\n]+) LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_PREFIX = TIME_FORMAT = %s%3N pulldown_type = 1 ... View more

DBX allows you to do that. It's possible to setup a database monitor on a sqlite database and index new records, when the database is updated. It's a commercial extension, though. ... View more

Already indexed data will not be altered by this operation. Any new data coming in should be broken into separate event according to your config. ... View more

Similar issue documented here: https://answers.splunk.com/answers/337286/after-removing-permission-dashboard-role-from-sear.html Fix was = "In short... DO NOT DISABLE THE SEARCH AND REPORTING APPLICATION FOR ANYONE". ... View more

Note that this search finds events where the fileInfections field exists, but has a value other than zero. So, it won't find events that do not have the fileInfections field at all. If you want to find those events as well, you would do ... NOT fileInfections = 0 | ... ... View more