Hi toledotiago, the input you opened is Splunk-TCP input to receive data from a Splunk Universal Forwarder in Splunk’s internal format, not any arbitrary tcp source. Take a look at https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Monitornetworkports for the tcp/udp input you are looking for. If you are dealing with syslog i highly recommend this blog: http://www.georgestarcher.com/splunk-success-with-syslog/ Sincerely hgrow ... View more

https://wiki.splunk.com/Deploy:SplunkBucketRetentionTimestampsAndYou ... View more

hi there, without answering your question .. splunk does not rotate per event but per bucket. so it can happen that very old AND new events get mixed together in one bucket and this specific bucket is only allowed ro rotate if all events matches your frozenTime-parameter so your bucket with old and new data is basicly not allowed to rotate. this can happen if your sourcetypes time extraction is off or you just get weird data indexed somehow or many many more reasons. There is a field called _bkt. you can check the time period for that specific bucket that holds older events than your frozentimeperiod. greetings ... View more

Hi there, not sure if still relevant but i just stumbled accross your question. Take a look at https://docs.splunk.com/Documentation/ES/4.7.2/Install/ImportCustomApps The idea is that splunks enterprise sercurity app does not read all other apps by default even knowledge objects are shared global. it is intended to protect any unwanted k.o. to currupt your es configuration by overwriting certen tags/field-extractions/etc. I have never tried to import a custom visualization but at leat you can give it a try. Update the "Application Regular Expression" to also match your custom app. Let us know if thats the trick 😉 ... View more

Hi, the goal of a splunk monitor particularly is to gather the information inside a file if its changed. Depending on your usecase it might be more suitable to gather the information you need from a different source, f.e. windows event log or unix auditd for file access/change events. In addition from a a security point of you will gather more imporatend information like a user or maybe a source ip wich accessed the ftp server. Maybe something to consider for your usecase. Greetings ... View more

As richgalloway mentioned copy past would be usefull. By the title I assume you are looking for the source and destination fields. For your first example inside:(?<src_ip>[^\/]+)\/(?<src_port>\d+) dst outside:(?<dest_ip>[^\/]+)\/(?<dest_port>\d+) might be a fitting regex. something something ... deny tcp src inside:123.123.123.123/444 dst outside:111.222.333.444/555 .... I personally would go with another extraction for your other example since both events are not quite similar but I'm sure someone else would combine both. For the second example permitted \w+ \w+\/(?<src_ip>[^\(]+)\(\w+\) -> outside\/(?<dest_ip>[^\(]+) might fit. something something ... permitted udp dmz/111.222.333.444(123) -> outside/123.123.123.123(123) .... ... View more

Hi there, while installing a universal forwarder did you configured the deployment server on your forwarder? Thats the step telling your forwarder about your splunk server. You can check: http://docs.splunk.com/Documentation/Splunk/6.5.2/Updating/Configuredeploymentclients If you did that, a problem can be a firewall between your universal forwarder and you splunk server, blocking the traffic when the UF phones home to the Deployment Server. Edit: From the Universal Forwarder Documentation: https://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Configuretheuniversalforwarder#Configure_the_universal_forwarder_to_connect_to_a_deployment_server After that the forwarder must appear as a client in splunk under Settings -> Forwarder Management -> Clients Greetings ... View more

Hi, your input and search looking correct. Steps from here ... 1) is your file path correct? 2) are there any problems splunk reports. look at index=_internal sourcetype=splunkd "tslog.txt" and check for any erros. F.e. the following example shows from the bottom to the top, that the tailingprocessor following the file and licenseusage reports that data are getting indexed. 02-10-2017 11:13:58.549 +0100 INFO LicenseUsage - type=Usage s="C:\\windows_log_test\\folder(123)\\test.log" st=tmp h="asdf" o="" idx="tmp" i="0E508918-B08F-4E61-97AD-BC9C4B6D706D" pool="auto_generated_pool_enterprise" b=9 poolsz=53687091200 02-10-2017 11:12:26.733 +0100 INFO TailingProcessor - Adding watch on path: C:\windows_log_test\folder(123)\test.log. 02-10-2017 11:12:26.733 +0100 INFO TailingProcessor - Parsing configuration stanza: monitor://C:\windows_log_test\folder(123)\test.log. Anything else would be noticable. 3) You can check if there is data in your index at all (if no other data is expected in the index): Settings -> indexes -> current size/event count Edit: some additional things you can try 4) alter your splunk spl, f.e. only search for index=ts OR index=* sourcetype="ts" 5) check the state of your input: | rest splunk_server=local /services/admin/inputstatus/TailingProcessor:FileStatus | transpose | search column=*tslog* Reference for 5) http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ 6) While adding the log with the wizard at some point you got a preview of your data, correct? If so are the timestamp correct? if - for some reason - the events get indexed in splunk with a timestamp in the future your search wont find these logs or they wont get indexed at all. Maybe something will show us, whats going on. ... View more

Hi akdake, Can you provide two things: 1) Configuration for your data-input. The easiest way is to take a look at the underlying inputs.conf which I guess is will be located in $SPLUNK_HOME$/etc/apps/serach/local/inputs.conf If you clicked through the wizard is most likely the app "search" your configuration is added. 2) The Splunk search you expect to find the data. Most likely just index=foo. There are just too many things to cover without additional information since going through the wizard should work fine. F.e. read-permission on the file, etc.... but first things first. Greetings ... View more

Hi there, I've seen similar behaviour with old splunk universal forwarders with a bug in setting correct guids for the splunk process on startup. Let your forwarder run ID with a scriped input: ../bin/id.sh id ../inputs.conf [script://./bin/id.sh] index = something_tmp interval = 3600 sourcetype = id Compare the out with running > id as local splunk user on the OS. Maybe it gives your more insights on whats going on ... View more

This guy wrote the best artical I've seen so far: http://www.georgestarcher.com/splunk-success-with-syslog/ Greetings ... View more