I have this search index="firewall" dest_ip=172.99.99.99 dest_port=* | stats count by src_ip,dest_port,action,src_user Instead of showing all src_ip's I want to group on the subnet part, that is using the dest_ip as an example, the three first (not being a network guy I might use the wrong wording 🙂 ) in the stats  172.99.99  My guess is rex, but guessing that there might be some other easier functions in Splunk for doing this? ... View more

Splunk Enterprise - Windows - 8.0.5 I have tried to enable the HTTP Event Collector following this guideline https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/UsetheHTTPEventCollector - made sure that HEC is enabled and then created a token.    [http://MyScript] disabled = 0 index = operations indexes = operations token = b68999b2-9f22-4b53-ba6e-0a8cfd505251 useACK = 0 description = HTTP EVent collector for script   From file    D:\Splunk\etc\apps\search\local\inputs.conf   Server restarted - but still    curl -k "https://splunkindex:8088/services/collector" {"text":"The requested URL was not found on this server.","code":404}   So whatever I do trying to post an event - fails    curl -k "https://splunkindex:8088/services/collector" -H "Authorization: Splunk b68999b2-9f22-4b53-ba6e-0a8cfd505251" -d '{"event": "Hello, world!", "sourcetype": "manual"}' {"text":"Invalid data format","code":6,"invalid-event-number":0}curl: (3) URL using bad/illegal format or missing URL curl: (6) Could not resolve host: sourcetype curl: (3) unmatched close brace/bracket in URL position 7: manual}'   but at least something is working    curl -k "https://splunkindex:8088/services/collector/health" {"text":"HEC is healthy","code":17}   Did also try    |rest /services/collector/health   but that fails - so I have not fully understod the "| rest" command.  Finally, ref https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/HTTPEventCollectortokenmanagement it says I can list the existing tokens using command    curl -k -u admin:password https://splunkindex:8089/servicesNS/admin/splunk_httpinput/data/inputs/http   But I cannot see any refrences to my token in the output.   <?xml-stylesheet type="text/xml" href="/static/atom.xsl"?> <feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> <title>http</title> <id>https://splunkindex:8089/servicesNS/admin/splunk_httpinput/data/inputs/http</id> <updated>2020-08-26T21:40:06+02:00</updated> <generator build="a1a6394cc5ae" version="8.0.5"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/admin/splunk_httpinput/data/inputs/http/_new" rel="create"/> <link href="/servicesNS/admin/splunk_httpinput/data/inputs/http/_reload" rel="_reload"/> <link href="/servicesNS/admin/splunk_httpinput/data/inputs/http/_acl" rel="_acl"/> <opensearch:totalResults>0</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> </feed>     ... View more

Splunk 8.0.4.1 on Windows 2016 Using a Heavy Forwarder to index syslog data, multiple ports with a sourcetype pr. port. All ports should be forwarded to our default indexer, but in addtion, pr. sourctype/port the data should be forwarded to an additional indexer (to our security operations center).  I have tried similar to Define typical forwarder deployment topologies but so far I have only been able to disable all forwarding, which is really not what I want 🙂 Is it possible to clone data defined pr. sourcetype to two IDX's? UPDATE I think I found the doc that I need : Perform selective indexing and forwarding need to read a bit more about _INDEX_AND_FORWARD_ROUTING ....I hope....     ... View more