We're combining many types of searches into one tabled alert. We create our own variables with an eval statement and pass log variables into these. On certain versions of Windows these log variables have different names (message vs name). So we're wondering how to have an 'OR' statement depending on which name we're given. Thanks. For example, we have tried the following: .... | eval "Event Description"=Message, name | table ... "Event Description" .... | eval ("Event Description"=Message) OR ("Event Description"=name) | table ... "Event Description" .... | eval "Event Description"=(Message) OR (name) | table ... "Event Description" .... | eval "Event Description"=Message OR name | table ... "Event Description" None of these seem to work. They usually give us malform eval expression errors. ... View more

So, I have my Phone Home Error search; when I type it into the Search Bar, it pulls up all hosts not connected. However, when I try to set it up as an alert, it will only send out an Alert for the first one that disconnected. I have it Throttled, but for suppressing those with the same host. Also, over time, it will stop pulling computers that have been disconnected from the server for more than 7 days. The only way to get them is to do an All Time search (using the search string from the alert). I'm a little lost, and would be thankful for any guidance. Thanks. My Search: | metadata type=hosts index=_internal | eval age=now()-recentTime | where age > 300 | eval "Time Indexed"=strftime(_time, "%Y/%d/%m %H:%M") | eval "Computer Host"=host | eval "Time Last Connected"=tostring(age, "duration") | eval "Date Last Connected"=strftime=)recentTime, ""%+") | table "Computer Host", "Time Last Connected", "Date Last Connected" My Alert Settings: ... View more

I am monitoring the percent usage of my CPU and RAM by entering the following in the search: (index=* host=* sourcetype"Perfmon:Memory" collection=Memory object=Memory counter="% Committed Bytes In Use") OR (index=* host=* sourcetype="Perfmon:CPU" counter="% Processor Time") | eval "Indexed Time"=strftime(_time, "%Y/%d/%m %H:%M") | eval "Computer Host"=host | eval "Event Type"=source | eval Object=object | eval "Percent Usage"=round(Value, 2)."%" | table "Indexed Time", "Computer Host", "Event Type", Object, "Percent Usage" It all comes out well, however I am only trying to make the events in which the 'Value' variable (both CPU and RAM) is above the integer, 50 (greater than 50%). I have tried putting the following in along with some other variations of it too: | where Value > 50 No errors are thrown on searching, but it pulls up zero results (which I have checked, and there are values greater than 50). My end goal is to make this an alert. Normally I would have these in two separate searches/alerts, but my boss wants it in one (hence the 'OR'). I have been looking through Splunk Docs and Splunk Answers, but I'm only getting information on using the "where" command. Any further help -- even if it's a helpful link -- would be greatly appreciated. Thank you. ... View more

When I enter In my the following into my Search... index=* host=* sourcetype="Perfmon"Memory" collection=Memory object=Memory counter="% Committed Bytes In Use" I receive logs containing information about memory usage. However, there is a variable called, Value. I'm assuming it has to do something with how many bytes are being committed... maybe? It would have to be too low of an actual value though; just seven bytes being used? Impossibly small. My end goal is to have a Time Chart of all the PC on my network with memory usage from the past 24 hours. I tried to look this up through Splunk Answers, Splunk Docs, and Window's Technet, but with no avail. Any assistance would be lovely. Example of Log: 07/24/2017 12:43:45.233 -0400 collection=Memory object=Memory counter="% Committed Bytes in Use" instance=0 Value=7.0622917708150004 ... View more

The Problem: I'm attempting to setup an alert for if one of my forwarder machines boots in Safe Mode. The data that's retrieved from Windows Event Viewer and Splunk Web Interface regarding booting-ups is: EventCode=12 EventType=4 Source: Kernal-General Message: The operating system started at system time <respected time stamp> Unfortunately, the above data is the same for both booting normally and booting in Safe Mode. The only way I can tell which is which, is from within the Windows Event Viewer, under the log's "Details", the variable BootMode will contain either a value of '0' for normal boot, or a value of '1' for Safe Mode boot. The Question: Is there a way (in Splunk) that I can search for this particular "BootMode" variable with its respected value? Otherwise, perhaps a different way to capture an event for Safe Mode Boot-ups? ... View more

I have searched across Splunk Answers, Docs, and the YouTube channel, but I'm still having an issue with setting up a proper alert. I need to setup an Alert so that if failed logins exceeds 4 attempts within 10 minutes, an alert will be triggered. I went into the Search, typed: index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by host, Account_Name, name | where count > 4 The search is then saved as an Alert: **Title:** <the name> **Description:** <the description> **Permissions:** Private ** Alert Type:** Real-time **Trigger Alert when:** Per-Result (No Throttling) The issue is that it pulls results every five seconds. It seems that the system checks the log within my given time frame, notices that there are still logs, so triggers another alert. I then tried switching my search to: index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by host, Account_Name, name with the following Alert Type: **Alert Type:** Real-time **Trigger alert when:** Number of Results **is** greater than 4 *in* 10 minute(s) **Trigger:** Once (No Throttle) However, when I do that, it pulls up nothing. Any help would be appreciated, I've been stuck on this for two days. ... View more

I have an offline network consisting of thirteen machines, one of them being the Splunk server. I wish to use one of the other computers (one of the hosts on the same network) to get the web interface. Those that will be searching the logs via the web interface will not have access to the Splunk server -- so they won't able to simply use http://localhost:8000, obviously. I'm assuming I'll need to make some sub-accounts maybe. I was just looking for some guidance. Thanks. ... View more