I have this search index="firewall" dest_ip=172.99.99.99 dest_port=* | stats count by src_ip,dest_port,action,src_user Instead of showing all src_ip's I want to group on the subnet part, that is using the dest_ip as an example, the three first (not being a network guy I might use the wrong wording 🙂 ) in the stats  172.99.99  My guess is rex, but guessing that there might be some other easier functions in Splunk for doing this? ... View more

Splunk Enterprise - Windows - 8.0.5 I have tried to enable the HTTP Event Collector following this guideline https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/UsetheHTTPEventCollector - made sure that HEC is enabled and then created a token.    [http://MyScript] disabled = 0 index = operations indexes = operations token = b68999b2-9f22-4b53-ba6e-0a8cfd505251 useACK = 0 description = HTTP EVent collector for script   From file    D:\Splunk\etc\apps\search\local\inputs.conf   Server restarted - but still    curl -k "https://splunkindex:8088/services/collector" {"text":"The requested URL was not found on this server.","code":404}   So whatever I do trying to post an event - fails    curl -k "https://splunkindex:8088/services/collector" -H "Authorization: Splunk b68999b2-9f22-4b53-ba6e-0a8cfd505251" -d '{"event": "Hello, world!", "sourcetype": "manual"}' {"text":"Invalid data format","code":6,"invalid-event-number":0}curl: (3) URL using bad/illegal format or missing URL curl: (6) Could not resolve host: sourcetype curl: (3) unmatched close brace/bracket in URL position 7: manual}'   but at least something is working    curl -k "https://splunkindex:8088/services/collector/health" {"text":"HEC is healthy","code":17}   Did also try    |rest /services/collector/health   but that fails - so I have not fully understod the "| rest" command.  Finally, ref https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/HTTPEventCollectortokenmanagement it says I can list the existing tokens using command    curl -k -u admin:password https://splunkindex:8089/servicesNS/admin/splunk_httpinput/data/inputs/http   But I cannot see any refrences to my token in the output.   <?xml-stylesheet type="text/xml" href="/static/atom.xsl"?> <feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> <title>http</title> <id>https://splunkindex:8089/servicesNS/admin/splunk_httpinput/data/inputs/http</id> <updated>2020-08-26T21:40:06+02:00</updated> <generator build="a1a6394cc5ae" version="8.0.5"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/admin/splunk_httpinput/data/inputs/http/_new" rel="create"/> <link href="/servicesNS/admin/splunk_httpinput/data/inputs/http/_reload" rel="_reload"/> <link href="/servicesNS/admin/splunk_httpinput/data/inputs/http/_acl" rel="_acl"/> <opensearch:totalResults>0</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> </feed>     ... View more

Splunk 8.0.4.1 on Windows 2016 Using a Heavy Forwarder to index syslog data, multiple ports with a sourcetype pr. port. All ports should be forwarded to our default indexer, but in addtion, pr. sourctype/port the data should be forwarded to an additional indexer (to our security operations center).  I have tried similar to Define typical forwarder deployment topologies but so far I have only been able to disable all forwarding, which is really not what I want 🙂 Is it possible to clone data defined pr. sourcetype to two IDX's? UPDATE I think I found the doc that I need : Perform selective indexing and forwarding need to read a bit more about _INDEX_AND_FORWARD_ROUTING ....I hope....     ... View more

It has been a while since I have worked with Linux, but doing my best to refresh my knowledge. Successfully installed the latest forwarder on Ubuntu and it has actually phoned home and the deployment server has pushed config to it. But now it has stopped working. I have configured it to run as user 'splunk', not as root. This has caused some issue, for instance when I just now did run splunk@myserver:~$ ./bin/splunk display deploy-client Pid file "/opt/splunkforwarder/var/run/splunk/splunkd.pid" unreadable.: Permission denied Pid file "/opt/splunkforwarder/var/run/splunk/splunkd.pid" unreadable.: Permission denied Operation "ospath_fopen" failed in /opt/splunk/src/libzero/conf-mutator-locking.c:337, conf_mutator_lock(); Permission denied Did sudo to root and /opt/splunkforwarder# chown -R splunk:splunk * Error did go away, but now when running the same command (as Splunk) nothing happens. I must CTRL+C to "get out of it" splunk@myserver:~$ ./bin/splunk display deploy-client ^C splunk@myserver:~$ Most likely more a basic Linux quesiton, but still, anyone who has an idea of what could be wrong? Update And now I did try splunk@myserver:~$ ./bin/splunk list forward-server Cannot initialize: /opt/splunkforwarder/etc/apps/learned/metadata/local.meta: Permission denied Cannot initialize: /opt/splunkforwarder/etc/apps/learned/metadata/local.meta: Permission denied Cannot initialize: /opt/splunkforwarder/etc/apps/learned/metadata/local.meta: Permission denied Since I did do the chown, this should not happen, so quite sure that I've done something not totally correct when installing as root and then switching to Splunk as described here https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot-start_as_a_non-root_user - well, it is simply just the chown-command, but since splunk@myserver:~$ ls -la /opt/splunkforwarder/etc/apps/learned/metadata/local.meta -rw------- 1 root root 531 Mar 8 19:15 /opt/splunkforwarder/etc/apps/learned/metadata/local.meta Something is not correct on the server. ... View more