Is there a way to do this on splunk cloud without reuploading the whole app? ... View more

It's probably due to the order of precedence of stanzas and the fact that the events incoming from the UF do not have the source set as you want it. The source file is being rewritten using transforms within the TA_windows app and you're trying to match the _resulting_ source. It won't match this way since splunk decides before applying transforms which stanzas are relevant for given event (as a result you can't - for example - create a loop with source rewrites; I tried :D) ... View more

no, i want the dest field in search1 be the src field in search 2 ... View more

Hi @khanlarloo  There is no hidden user concept in Splunk, if you login the SH cluster/standalone you can find users there local to splunk , LDAP and SAML. It depends what kind of Auth model you have? Authentication, Autherisation conf files on SH to find the user you are looking for exist? Do under bin, grep user that you are looking for -  ./splunk btool authentication list --debug  --- An upvote would be appreciated if this reply helps! ... View more

I did everything you said according to the link you sent, but there is still the same problem. ... View more

Hi, did you find the solution? I have same problem ... View more

it doesn't work. ... View more

Hi @khanlarloo, if it's only to identify the flow, you could override host using the link I honted, so you can maintainal the knowledge objects related to the same sourcetype. If you anyway want to override sourcetype follow the instructions in the above url: [fw-sourcetype] REGEX = FG1092 DEST_KEY = MetaData:sourcetype FORMAT = sourcetype::fortigate Ciao. Giuseppe ... View more

Could it be the Active Directory audit policy needs to be set to log these events? https://docs.splunk.com/Documentation/MSExchange/3.5.2/DeployMSX/ConfigureActiveDirectoryauditpolicy ... View more

@khanlarloo do up-vote the answer if it helped 🙂 ... View more

What is "send alert"? If you want to change the time range depending on the day of the week, it is easy to duplicate the alert and set the time range for each one. ... View more

if i want to say if index=a then go to specific page how can i say ? my query is : index= a or index=b | stats count by index i using chart ... View more

Try this: index="fw" policyid=143 | timechart span=1m sum(bytes_out) AS sent sum(bytes_in) AS received BY user | foreach sent* received* [ eval <<FIELD>> = round('<<FIELD>>'/131072, 2) ] |eval send=round((bytes_out)/131072,2) |eval receive=round((bytes_in)/131072,2) ... View more

Hi, I have see this a number of times and is generally related to the security policy on the source server. If the UF is running as system or an AD account, like larkshman239 says, check that it has permissions. There is more detailed set of security requirements relating to the security descriptors that are used to allow access, these differ on a Win2008 box and above. Read the following and check to make sure that they are set to allow access. I appreciate that this relates to setting the SDDL however it tells you how to understand whether you have the required access. I have seen this on a windows 2016 server so it is relevant. https://support.microsoft.com/en-gb/help/323076/how-to-set-event-log-security-locally-or-by-using-group-policy ... View more

thank you. ... View more

Are you looking for round brackets ()? Then just append it... 🙂 eval A="(".A.")"; ... View more

no my problem didn't solved ... View more

we install this app for forigate firewall,but we need fortiweb (web application firewall) ... View more

hi @khanlarloo, Thanks for posting. Would you mind approving the answer above if @richgalloway answered your question. That way, people know that that is the correct solution. Thanks!! ... View more

@khanlarloo I have converted @493669 's comment to Answer. Please accept the same to mark this question as answered! ... View more

In your transforms, try putting nullQueue 2nd TRANSFORMS-null= setparsing, setnull Make sure you reload the data to see the effect ... View more

no both of them send their logs to the same sourcetype and index ... View more

can you tell why my charts have no result? ... View more

if i want to search base on host name how can i write the regex format? host="12.13.2.1" host="2.1.1.4" ... View more

thank you for your response. i will do this and inform you. ... View more