This is an old post so a known issue. I think folks using ES app or using Splunk as a SIEM and almost any US Govt supplier will need most of that 'extra' info for any IT sec forensic analysis. Most all US Govt suppliers are subject to NIST now and CMMC coming in 2024. I would imagine HIPPA, SOX, GDPR, GLBA, and CCPA companies systems will need that as well. It is noisy but attacks are very often using non-standard ports to transfer information/data to/from an outside host like ICMP, SSH, and RDP as most application level IDS/IPS are looking at 80/443 inspection. For general SMB and Small Enterprise this is probably viable in some respects though. ... View more

As I've learned recently, there's nothing stopping someone from defining a different Host value in an input, and causing that problematic situation much more quickly and broadly.  This seems like a huge oversight in functionality. ... View more

This is a poor workaround and results in errors in the btool.log for one.  This needs a better supported solution for checking deployment apps before they are pushed out (or after). /opt/splunk/bin/splunk btool check --dir=/opt/splunk/etc/deployment-apps-symlink --debug | grep Splunk_TA_windows Even with or without the symlink to 'system' under this new deployment-apps-symlink, there are btool errors about spec files either not being present, or being in the incorrect place as per.     ... View more

I have tried all these too and cannot seem to get deployment server apps checked. the btool output is simply silent. ... View more

You can also check inbound EventsPerSecond or Kbps similarly: index=_internal "group=thruput" host=myhosts* | timechart avg(instantaneous_eps) by host span=1m or index=_internal "group=thruput" host=myhosts* | timechart avg(instantaneous_kbps) by host span=1m naturally you'd check these in a real-time or short window if you are looking for what is happening at that minute. ... View more

I know this has been around a while, but I felt I should share this with the community. You can incorporate the eval statement into the stats command: EG: | stats avg(eval(round(duration,0))) AS Avg_Duration [https://docs.splunk.com/Documentation/Splunk/7.2.5/Search/Usestatswithevalexpressionsandfunctions] This especially works well when you are using a split by statement. EG: | stats avg(eval(duration(count,0))) AS Avg_Duration by something ... View more