Good morning everyone, I am trying to find the difference between to fields. I have tried the eval command to subtract between the 2 fields and I have also tried to use the delta command to find the difference. Is there something that i am missing to accomplish this? Here is the search that i am using below: index=abc sourcetype=xxx field=xyz |stats count by Code | stats sum(count) as total2 | append [search index=abc sourcetype=xxx field=xyz | stats count as total ] | eval total3=(total - total2) | table total, total2, total3 Thank you all for your help with. It seems so simple to me but i just can't get it to work or I am missing something. Thanks again everyone. ... View more

Hello Everyone, The issue is that we are collecting CyberArk logs using the CyberArk add on 1.0.0. CyberArk is creating multiple sub directories on the monitored location and we are only capturing what is being written in the 2 vault directories. We feel that we are not capturing all of the CYberArk logs as they create a new directories for every log. The only constant is that all of sub directories are being created in the Directiory folder named xxx. Is there a away that Splunk can just read from the xxx folder and capture all of the logs that being written in the sub directories? We have open a ticket with CyberArk on the CyberArk creating the multiple sub directories but no work able solution has been provided. Please let me know if you need anymore information. Thank you for your help everyone. ... View more

Hi Splunkers, I am looking for some help in creation of regular expression to Anonymize data with a regular expression in a transforms. Link: https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Anonymizedata Current Log format: Timestamp | Category | Machine | ApplicationDomain | ProcessId | ProcessName | ThreadId | LogID | UserName | ActionName | Module | AuthorizationStatus | RequestedBy | RequestingURL | QueryString | HTTPVerb | ClientIP| LogEvent="Response",MethodName="get.complete",ActionResult="Success",ApplicationNumber="1234567890",ApplicationLanguage="1",Section="SUMMARY",FirstName="Shrelock",LastName="Holmes",Gender="M",DateOfBirth="7/19/1976",SocialSecurityNumber="123456789",MaritalStatus="0",RaceInformation="Item8",CitizenshipCode="1",County="20",AddressLine1="221 Baker Street",City="Marylebone",State="London" I want to write a regular expression to mask all key value pairs which start after ‘,MethodName="get.complete",’ (i.e ApplicationNumber, FirstName, DateOfBirth, SocialSecurityNumber, MaritalStatus ,etc) Order of the field till Method name is constant and is never changing. Every event would have exact order till “MethodName” and additional PII elements added after the “MethodName”. Unchanged order of the field Example: Timestamp | Category | Machine | ApplicationDomain | ProcessId | ProcessName | ThreadId | LogID | UserName | ActionName | Module | AuthorizationStatus | RequestedBy | RequestingURL | QueryString | HTTPVerb | ClientIP| LogEvent="Response",MethodName="get.complete", Note: The location of the fields to masked may change at time but it will always be in a key value pair format. (i.e ,ApplicationNumber="1234567890",ApplicationLanguage="1",Section="SUMMARY",FirstName="Sherlock",LastName="Holmes",Gender="M",DateOfBirth="7/19/1976") Following are the solution I was planning to use to mask data at index time. PROPS Example Using SEDCMD Regex: [sourcetype] **SEDCMD-mask = regex to skip first three key-value pair and mask rest OR** Transforms Example Using regex: [ssn-anonymizer] REGEX = regex to capture ssn FORMAT = format to mask entire data DEST_KEY = _raw Thank you for all of your help and advice. ... View more

I have a table in splunk that has the following fields: Tool; End_Of_Support; The End_Of_Support field has different dates listed in it in the following format: 1/01/2017. The data is coming from a monitored file on my system and is only updated when I update the file. Is there a way that i can highlight the End_Of_Support field cell red if the date within that cell is within 7 days of that value? Thank you for you help and support? ... View more