hello, trying to capture DNS log traffic from an Active Directory Domain Controller. the topology is this: cloud splunk instance, heavy forwarder on my LAN and universal forwarder on the DC. i  see multiple Stream apps in the splunk store - which app goes where? There is "Splunk App for Stream" then there's "Splunk Add-on for Stream Forwarders" then there's something called "Splunk Add-on for Stream Wire Data" - can you please help? ... View more

Our cloud instance was upgraded 3 days ago, since then the log volume increased by about 20% - we're logging same amount of data as for the past 3+ years - have anyone had to deal with similar issue?    I looked at indexes - they all seem to increased logging proportionally, which leads me to believe it a change in the current version...that made it "less efficient" in this respect...   Thanks! ... View more

Hello, We have recently installed this Azure add-on. I can successfully receive data from O365 Management APIs, Azure resources ....however, the only data we really need is data that can be accessed from Azure portal by going to Azure Active Directory -> Activity -> Sign-ins and Audit Logs Have anyone had any success pulling in this data? Thanks! ... View more

Hello, I have a report that shows me network events - most of the events will have "source ip" coming from a proxy and destination being some url. Is there a way to formulate report query so that it contains the actual source of that event based on another "nested" search that would identify the client that originated the proxy request (there would be something in common there, most likely a destination IP) Thanks! ... View more

Hello, When creating tables, i have noticed that if i start renaming fields - for display clarity purpose - like for example "src_ip" to "Source IP", i can't drill down to the original log (search runs but finds nothing) - is there an easy way to get both "nice" looking column header and "drillability"? Thanks! ... View more

Hello, I'm in the process of configuring the Splunk App for Windows Infrastructure on our Splunk Cloud. One component I'm having issues with is SA-LDAPSearch. I don't provide external LDAP access, so I have installed the app on a heavy forwarder on my LAN. I have set up ldap.conf file to provide LDAP connectivity information. I'm confused what the next step should be. Instructions call for creating an index on both indexer and forwarder - but how do I associate this index with the app? How do I "forward" the app functionality to Splunk Cloud, so all the WINFRA reports that rely on LDAP searches return correct information? Thanks ... View more

Hello, We have several comma delimited logs with static set of fields. I want to extract the fields with use of regex. Here's my current regex, where the result is the content between 11th and 12th comma (in a log with 40 fields) . This however does not account for commas within the fields (LDAP results for example) - these are isolated with quotation marks. | rex field=_raw "(?:[^\,]*\,){11}(?<Result>.*)(?:[^\,]*\,){28}"| I need help with modifying my regex to ignore contents between quotation marks - i'd appreciate if someone who maybe had the same issue, could help. Thanks! ... View more

Hello, Can someone help me to build a table report by extracting 3 fields from a comma separated log: Here's a log example: 2017-05-03 13:30:36 User.Error 10.40.11.241 2017-05-03 17:30:35,987, , audit.runtime.com.rsa.authmgr.internal.protocol.ace.AuthV4RequestHandler, ERROR, eec1c356f110280a7888f02ad5a2b3e9,1336c44ff110280a0801a35a997a135e,10.40.11.11,10.40.16.241,AUTH_PRINCIPAL_RESOLUTION,23008,FAIL,AUTH_RESOLUTION_FAILED_BY_ID_ALIAS,,,,,ptr555,,,1c0931660610330a1a1eb51b527f5700,000000000000000000001000e0011000,10.40.18.73,njx-domain..net,1,,,,,,,1,,,,,,,, desired result would be a table with a result: ptr555|FAIL|AUTH_RESOLUTION_FAILED_BY_ID_ALIAS Thanks! ... View more