Hi Team, I've come across an odd problem, and I'm not sure where to start in troubleshooting. Once a week, on a Sunday, we ingest a csv file that contains all of our assets (splunk_devices.csv). Recently, we have noticed that there are assets in the asset list that are not present in our asset index. Last week, for example, our static file contained 28k assets and the data ingested by Splunk only had 24k. I reviewed the list myself and can confirm that the assets were missing from Splunk. I ingested the file into my personal development environment with dev license and had no issues at all - All 28k assets were present and accounted for. I've found no error messages in Splunk, or any other indicators to start troubleshooting with. Does anyone have any ideas what we could check? We're using Splunk Cloud, so have no access to indexers or search heads, but can access our forwarder infrastructure. ... View more

Hi Team, I'm writing a search that will alert when a user account authenticates and is granted privileges. Our admin-team often use the Remote Control Viewer to remote into assets, and we would like to exclude them. Unfortunately, we don't have a standardised naming convention, so we can exclude some admin accounts, but not all of them. I want to write a search that takes the Account_Name, and then runs a sub-search to identify whether that Account_Name has been associated with the New_Process_Name of *RemoteControlViewer.exe and, if they have, exclude them. I've got the below logic and I've played around with multiple types of join and appendcols, but I'm getting nowhere. Can someone help? sourcetype=WinEventLog:Security (EventCode=4732 OR EventCode=4672) AND (Account_Name!="svc*" Account_Name!="SYSTEM" Account_Name!="*$" Account_Name!="*dmin" Account_Domain="<DOMAIN>") | join Account_Name [ search sourcetype=WinEventLog:Security EventCode=4688 | stats values(New_Process_Name) AS NPN by Account_Name | fields NPN] | search NOT [| inputlookup WL_Global | rename src as Source_Network_Address | fields Source_Network_Address] | search NOT [| inputlookup WL_B_10_104 | fields Account_Name, host] | fillnull value=N/A Group_Domain Group_Name | eval Target_Account=mvindex(Security_ID, -0) | convert ctime(_time) as Time timeformat="%H:%M:%S %d/%m/%y" | stats values(Account_Domain) as Account_Domain values(NPN) as New_PN values(name) as name values(Group_Name) as Group_Name values(Group_Domain) as Group_Domain by Account_Name host Time | search New_PN!=*RemoteControlViewer.exe | fields Time Account_Name host Account_Domain name Group_Name Group_Domain Any assistance would be greatly appreciated. ... View more

Hi team, I hope that we are all well? I'm looking to develop a use case designed to identify where an endpoint has seen a spike in outbound communications. I've been trying to use the predict command - this is great for determining spikes in network traffic in general, but I can't seem to tighten it to look at endpoints on a host-by-host basis. I'd love for some logic that would identify the endpoint responsible for the spike in network traffic, rather than just a "oh, there's been a spike in network traffic, but who knows which endpoint was responsible". My logic for determining spikes is as below: | tstats summariesonly=f prestats=t count FROM datamodel=Network_Traffic where nodename=All_Traffic earliest=-25h latest=-1h by _time span=5m | timechart span=5m count as Network_Traffic | predict Network_Traffic as Predicted_Traffic | rename upper95(Predicted_Traffic) as Ceiling Any assistance would be greatly appreciated 🙂 Kind regards, Mike ... View more