Hi toledotiago, the input you opened is Splunk-TCP input to receive data from a Splunk Universal Forwarder in Splunk’s internal format, not any arbitrary tcp source. Take a look at https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Monitornetworkports for the tcp/udp input you are looking for. If you are dealing with syslog i highly recommend this blog: http://www.georgestarcher.com/splunk-success-with-syslog/ Sincerely hgrow ... View more

saved my day. thank you ! ... View more

"I am possibly not placing them in the right location?" From http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Forwarding/Routeandfilterdatad "You can configure routing only on a heavy forwarder. " If you placed the filtering-configuration on your Universal Forwarder that is the wrong place since the UF does not parse the data. In other words it 's not looking into your data and applying your transformation. You have to place the configuration on the first splunk-system thats acutaly parsing, which is most likely your indexer. Sincerely ... View more

https://wiki.splunk.com/Deploy:SplunkBucketRetentionTimestampsAndYou ... View more

hi there, without answering your question .. splunk does not rotate per event but per bucket. so it can happen that very old AND new events get mixed together in one bucket and this specific bucket is only allowed ro rotate if all events matches your frozenTime-parameter so your bucket with old and new data is basicly not allowed to rotate. this can happen if your sourcetypes time extraction is off or you just get weird data indexed somehow or many many more reasons. There is a field called _bkt. you can check the time period for that specific bucket that holds older events than your frozentimeperiod. greetings ... View more

Hi there, not sure if still relevant but i just stumbled accross your question. Take a look at https://docs.splunk.com/Documentation/ES/4.7.2/Install/ImportCustomApps The idea is that splunks enterprise sercurity app does not read all other apps by default even knowledge objects are shared global. it is intended to protect any unwanted k.o. to currupt your es configuration by overwriting certen tags/field-extractions/etc. I have never tried to import a custom visualization but at leat you can give it a try. Update the "Application Regular Expression" to also match your custom app. Let us know if thats the trick 😉 ... View more

Hi, the goal of a splunk monitor particularly is to gather the information inside a file if its changed. Depending on your usecase it might be more suitable to gather the information you need from a different source, f.e. windows event log or unix auditd for file access/change events. In addition from a a security point of you will gather more imporatend information like a user or maybe a source ip wich accessed the ftp server. Maybe something to consider for your usecase. Greetings ... View more

As richgalloway mentioned copy past would be usefull. By the title I assume you are looking for the source and destination fields. For your first example inside:(?<src_ip>[^\/]+)\/(?<src_port>\d+) dst outside:(?<dest_ip>[^\/]+)\/(?<dest_port>\d+) might be a fitting regex. something something ... deny tcp src inside:123.123.123.123/444 dst outside:111.222.333.444/555 .... I personally would go with another extraction for your other example since both events are not quite similar but I'm sure someone else would combine both. For the second example permitted \w+ \w+\/(?<src_ip>[^\(]+)\(\w+\) -> outside\/(?<dest_ip>[^\(]+) might fit. something something ... permitted udp dmz/111.222.333.444(123) -> outside/123.123.123.123(123) .... ... View more

^\w+\s+(?<field>.{2}) might do it? ... View more

Hi there, while installing a universal forwarder did you configured the deployment server on your forwarder? Thats the step telling your forwarder about your splunk server. You can check: http://docs.splunk.com/Documentation/Splunk/6.5.2/Updating/Configuredeploymentclients If you did that, a problem can be a firewall between your universal forwarder and you splunk server, blocking the traffic when the UF phones home to the Deployment Server. Edit: From the Universal Forwarder Documentation: https://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Configuretheuniversalforwarder#Configure_the_universal_forwarder_to_connect_to_a_deployment_server After that the forwarder must appear as a client in splunk under Settings -> Forwarder Management -> Clients Greetings ... View more

You should just be able to leave out esixs \w+ if im correct 🙂 In your case it should not matter what is coming after the first 6 digits --whitespaces or some characters since you will always want the digits right after the beginning of the line. ^\d{2}(?<mystring>\d{6}) ... View more

Hi there, if your capturing group is already matching, you can just pull the first two digets (\d{2}) out of the capturing group. just execute this as an example: | makeresults | eval test="0035373112473B" | rex field=test "\d{2}(?<ITEM>\d{6})" Greetings Edited the regex 🙂 ... View more

Hi, your input and search looking correct. Steps from here ... 1) is your file path correct? 2) are there any problems splunk reports. look at index=_internal sourcetype=splunkd "tslog.txt" and check for any erros. F.e. the following example shows from the bottom to the top, that the tailingprocessor following the file and licenseusage reports that data are getting indexed. 02-10-2017 11:13:58.549 +0100 INFO LicenseUsage - type=Usage s="C:\\windows_log_test\\folder(123)\\test.log" st=tmp h="asdf" o="" idx="tmp" i="0E508918-B08F-4E61-97AD-BC9C4B6D706D" pool="auto_generated_pool_enterprise" b=9 poolsz=53687091200 02-10-2017 11:12:26.733 +0100 INFO TailingProcessor - Adding watch on path: C:\windows_log_test\folder(123)\test.log. 02-10-2017 11:12:26.733 +0100 INFO TailingProcessor - Parsing configuration stanza: monitor://C:\windows_log_test\folder(123)\test.log. Anything else would be noticable. 3) You can check if there is data in your index at all (if no other data is expected in the index): Settings -> indexes -> current size/event count Edit: some additional things you can try 4) alter your splunk spl, f.e. only search for index=ts OR index=* sourcetype="ts" 5) check the state of your input: | rest splunk_server=local /services/admin/inputstatus/TailingProcessor:FileStatus | transpose | search column=*tslog* Reference for 5) http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ 6) While adding the log with the wizard at some point you got a preview of your data, correct? If so are the timestamp correct? if - for some reason - the events get indexed in splunk with a timestamp in the future your search wont find these logs or they wont get indexed at all. Maybe something will show us, whats going on. ... View more

Hi akdake, Can you provide two things: 1) Configuration for your data-input. The easiest way is to take a look at the underlying inputs.conf which I guess is will be located in $SPLUNK_HOME$/etc/apps/serach/local/inputs.conf If you clicked through the wizard is most likely the app "search" your configuration is added. 2) The Splunk search you expect to find the data. Most likely just index=foo. There are just too many things to cover without additional information since going through the wizard should work fine. F.e. read-permission on the file, etc.... but first things first. Greetings ... View more

Hi there, I've seen similar behaviour with old splunk universal forwarders with a bug in setting correct guids for the splunk process on startup. Let your forwarder run ID with a scriped input: ../bin/id.sh id ../inputs.conf [script://./bin/id.sh] index = something_tmp interval = 3600 sourcetype = id Compare the out with running > id as local splunk user on the OS. Maybe it gives your more insights on whats going on ... View more

This guy wrote the best artical I've seen so far: http://www.georgestarcher.com/splunk-success-with-syslog/ Greetings ... View more

Hi there, good the input is finally working. First off there are no splunk board panels wich will give you some dashboards about your data. In some cases you might fine something product-specific at https://splunkbase.splunk.com/ to download it as an app but im pretty sure there is nothing for your Hirschmann. But since you have splunk it's easy to build yourself just with splunk spl. But first things first...maybe you've already noticed but if you take a look at your screenshot in the first event are actually 3 evenets merged together. That's something you dont want! Since you gave your events a custom sourcetype "hirsch" you will need to put some efforts in to let splunk understand the data correctly. Maybe you should read: http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Whysourcetypesmatter and http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Createsourcetypes A quicker way might be to change the sourcetype of your input to "syslog" since it's syslog what your switchs sends you. Some things might work out of the box. A correct "event breaking/line breaking" is what you need to achieve. From that point on you can start to gather information, extract fields and build some nice dashboards 🙂 Since there are many things on the way - way to mutch to cover all here - i suggest you start with some splunk tutorials like http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchTutorial/WelcometotheSearchTutorial. Greetings ... View more

Hey, hmm .... this is more like poking around in the dark... I'm not quite sure if wireshark comes before or after the windows firewall. another point of failure might be the windows firewall. You can try to create a new firewall-rule for incoming UDP/514. If thats not the trick you can post your inputs.conf with the data-input you've created to check if somethings going wrong there. Regards. ... View more

Hi maryang, execute the following search in splunk: | makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>.*)-" Your regex is not quite right. Your capturing group must be a so called "naming group" Next . just referes to any character except line break but just once. you want any character until a - . By following your approch you will add * (zero or more times) to the . . A maybe little bit better approach might be to capture everything from the beginning of the line which is not a - : | makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>^[^-]+)-" Sincerely, hgrow ... View more

Hi there, hi just can aid richgalloways idear of the inputs.conf you use is not in place. The data you are talking about comes from a server wich is not your splunk server itself, since you sad the data is coming in from your forwarder. Even though your inputs.conf is written on the splunk-instance, it is deployed to your universal forwarders (UF) and needs to be active there. When you restart the splunk server, is it the splunk server or the universal forwarder after(!) it pulled the new configuration? How are you deploying your inputs?. If you edit the inputs.conf in a deployment app ($SPLUNK_HOME$/etc/deployment-apps//local/inputs.conf) you can configure the app to autmaticly restart the Universal Forwarder after the app got redeployed. Everything to read should be found here: http://docs.splunk.com/Documentation/Splunk/6.5.1/Updating/Createdeploymentapps https://docs.splunk.com/Documentation/Splunk/6.5.1/Updating/Updateconfigurations Besides a correct deployment process I've noticed something while going through the documentation about WindowsEvent-Monitoring. There is difference between the the two blacklist-filtering formats you can apply in your configuration. I'm pretty sure I've already used the 2nd "advanced filtering" mode already in some configurations. You can give it a try! When using the Event Log code/ID format: For multiple codes/IDs, separate the list with commas. For ranges, use hyphens (for example "0-1000,5000-1000"). When using the advanced filtering format: Use '=' between the key and the regular expression that represents your filter (for example "blacklist = EventCode=%^1([8-9])$%" You can have multiple key/regular expression sets in a single advanced filtering entry. Splunk software conjuncts the sets logically. This means that the entry is valid only if all of the sets in the entry are true. You can specify up to 10 blacklists per stanza by adding a number to the end of the blacklist attribute, for example blacklist1...blacklist9. http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorWindowseventlogdata Greetings ... View more

Hi responsys_cm, this is not a direct answer to your question but recently i got pointed at this blog about win-event-log: http://blogs.splunk.com/2014/11/04/splunk-6-2-feature-overview-xml-event-logs/ Maybe the xml-field-extractions are a bit more robust and already solve the problem with the key-value-extraction. Additionally it comes with more benifits wich are described in the blog. Atleast something worth a try? Greetings. ... View more

Hi there, maybe the eval-statement mvdedup is what you are looking for. You can just execute the query below as an example: | stats count | eval msg="this is from: 101,102,103,101,104,102,103,105,106" | rex max_match=99 field=msg "(?<msg_from>\d+" | eval u_msg_from=mvdedup(msg_from) Greetings hgrow ... View more

Hi alexisall, your windows task-manager is showing you under what user your splunkd-proces is running. If thats 'SYSTEM' thats not a problem for reciving data from 514. If you dont see any data coming in on your wireshark it may be the root cause, that logs from your server don't even reach your PC, so what is wrong might be the switch-configuration or something on the line is blocking the data your switch is sending to your splunk. Hard to tell what might be the issue there. First I would check anything that might block the connection for UDP/514 data. Firewall, etc. in your network might block things? If you "putty" with a "cennection refused" i assume thats from your pc to your switch. thats the wrong direction anyway. Regards ... View more