Hi toledotiago, the input you opened is Splunk-TCP input to receive data from a Splunk Universal Forwarder in Splunk’s internal format, not any arbitrary tcp source. Take a look at https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/Monitornetworkports for the tcp/udp input you are looking for. If you are dealing with syslog i highly recommend this blog: http://www.georgestarcher.com/splunk-success-with-syslog/ Sincerely hgrow ... View more

saved my day. thank you ! ... View more

"I am possibly not placing them in the right location?" From http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Forwarding/Routeandfilterdatad "You can configure routing only on a heavy forwarder. " If you placed the filtering-configuration on your Universal Forwarder that is the wrong place since the UF does not parse the data. In other words it 's not looking into your data and applying your transformation. You have to place the configuration on the first splunk-system thats acutaly parsing, which is most likely your indexer. Sincerely ... View more

https://wiki.splunk.com/Deploy:SplunkBucketRetentionTimestampsAndYou ... View more

hi there, without answering your question .. splunk does not rotate per event but per bucket. so it can happen that very old AND new events get mixed together in one bucket and this specific bucket is only allowed ro rotate if all events matches your frozenTime-parameter so your bucket with old and new data is basicly not allowed to rotate. this can happen if your sourcetypes time extraction is off or you just get weird data indexed somehow or many many more reasons. There is a field called _bkt. you can check the time period for that specific bucket that holds older events than your frozentimeperiod. greetings ... View more

Hi there, not sure if still relevant but i just stumbled accross your question. Take a look at https://docs.splunk.com/Documentation/ES/4.7.2/Install/ImportCustomApps The idea is that splunks enterprise sercurity app does not read all other apps by default even knowledge objects are shared global. it is intended to protect any unwanted k.o. to currupt your es configuration by overwriting certen tags/field-extractions/etc. I have never tried to import a custom visualization but at leat you can give it a try. Update the "Application Regular Expression" to also match your custom app. Let us know if thats the trick 😉 ... View more

Hi, the goal of a splunk monitor particularly is to gather the information inside a file if its changed. Depending on your usecase it might be more suitable to gather the information you need from a different source, f.e. windows event log or unix auditd for file access/change events. In addition from a a security point of you will gather more imporatend information like a user or maybe a source ip wich accessed the ftp server. Maybe something to consider for your usecase. Greetings ... View more

As richgalloway mentioned copy past would be usefull. By the title I assume you are looking for the source and destination fields. For your first example inside:(?<src_ip>[^\/]+)\/(?<src_port>\d+) dst outside:(?<dest_ip>[^\/]+)\/(?<dest_port>\d+) might be a fitting regex. something something ... deny tcp src inside:123.123.123.123/444 dst outside:111.222.333.444/555 .... I personally would go with another extraction for your other example since both events are not quite similar but I'm sure someone else would combine both. For the second example permitted \w+ \w+\/(?<src_ip>[^\(]+)\(\w+\) -> outside\/(?<dest_ip>[^\(]+) might fit. something something ... permitted udp dmz/111.222.333.444(123) -> outside/123.123.123.123(123) .... ... View more

^\w+\s+(?<field>.{2}) might do it? ... View more

Hi there, while installing a universal forwarder did you configured the deployment server on your forwarder? Thats the step telling your forwarder about your splunk server. You can check: http://docs.splunk.com/Documentation/Splunk/6.5.2/Updating/Configuredeploymentclients If you did that, a problem can be a firewall between your universal forwarder and you splunk server, blocking the traffic when the UF phones home to the Deployment Server. Edit: From the Universal Forwarder Documentation: https://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Configuretheuniversalforwarder#Configure_the_universal_forwarder_to_connect_to_a_deployment_server After that the forwarder must appear as a client in splunk under Settings -> Forwarder Management -> Clients Greetings ... View more

You should just be able to leave out esixs \w+ if im correct 🙂 In your case it should not matter what is coming after the first 6 digits --whitespaces or some characters since you will always want the digits right after the beginning of the line. ^\d{2}(?<mystring>\d{6}) ... View more

Hi there, if your capturing group is already matching, you can just pull the first two digets (\d{2}) out of the capturing group. just execute this as an example: | makeresults | eval test="0035373112473B" | rex field=test "\d{2}(?<ITEM>\d{6})" Greetings Edited the regex 🙂 ... View more

Hi, your input and search looking correct. Steps from here ... 1) is your file path correct? 2) are there any problems splunk reports. look at index=_internal sourcetype=splunkd "tslog.txt" and check for any erros. F.e. the following example shows from the bottom to the top, that the tailingprocessor following the file and licenseusage reports that data are getting indexed. 02-10-2017 11:13:58.549 +0100 INFO LicenseUsage - type=Usage s="C:\\windows_log_test\\folder(123)\\test.log" st=tmp h="asdf" o="" idx="tmp" i="0E508918-B08F-4E61-97AD-BC9C4B6D706D" pool="auto_generated_pool_enterprise" b=9 poolsz=53687091200 02-10-2017 11:12:26.733 +0100 INFO TailingProcessor - Adding watch on path: C:\windows_log_test\folder(123)\test.log. 02-10-2017 11:12:26.733 +0100 INFO TailingProcessor - Parsing configuration stanza: monitor://C:\windows_log_test\folder(123)\test.log. Anything else would be noticable. 3) You can check if there is data in your index at all (if no other data is expected in the index): Settings -> indexes -> current size/event count Edit: some additional things you can try 4) alter your splunk spl, f.e. only search for index=ts OR index=* sourcetype="ts" 5) check the state of your input: | rest splunk_server=local /services/admin/inputstatus/TailingProcessor:FileStatus | transpose | search column=*tslog* Reference for 5) http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ 6) While adding the log with the wizard at some point you got a preview of your data, correct? If so are the timestamp correct? if - for some reason - the events get indexed in splunk with a timestamp in the future your search wont find these logs or they wont get indexed at all. Maybe something will show us, whats going on. ... View more

Hi akdake, Can you provide two things: 1) Configuration for your data-input. The easiest way is to take a look at the underlying inputs.conf which I guess is will be located in $SPLUNK_HOME$/etc/apps/serach/local/inputs.conf If you clicked through the wizard is most likely the app "search" your configuration is added. 2) The Splunk search you expect to find the data. Most likely just index=foo. There are just too many things to cover without additional information since going through the wizard should work fine. F.e. read-permission on the file, etc.... but first things first. Greetings ... View more

Hi there, I've seen similar behaviour with old splunk universal forwarders with a bug in setting correct guids for the splunk process on startup. Let your forwarder run ID with a scriped input: ../bin/id.sh id ../inputs.conf [script://./bin/id.sh] index = something_tmp interval = 3600 sourcetype = id Compare the out with running > id as local splunk user on the OS. Maybe it gives your more insights on whats going on ... View more

This guy wrote the best artical I've seen so far: http://www.georgestarcher.com/splunk-success-with-syslog/ Greetings ... View more

Hi there, good the input is finally working. First off there are no splunk board panels wich will give you some dashboards about your data. In some cases you might fine something product-specific at https://splunkbase.splunk.com/ to download it as an app but im pretty sure there is nothing for your Hirschmann. But since you have splunk it's easy to build yourself just with splunk spl. But first things first...maybe you've already noticed but if you take a look at your screenshot in the first event are actually 3 evenets merged together. That's something you dont want! Since you gave your events a custom sourcetype "hirsch" you will need to put some efforts in to let splunk understand the data correctly. Maybe you should read: http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Whysourcetypesmatter and http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Createsourcetypes A quicker way might be to change the sourcetype of your input to "syslog" since it's syslog what your switchs sends you. Some things might work out of the box. A correct "event breaking/line breaking" is what you need to achieve. From that point on you can start to gather information, extract fields and build some nice dashboards 🙂 Since there are many things on the way - way to mutch to cover all here - i suggest you start with some splunk tutorials like http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchTutorial/WelcometotheSearchTutorial. Greetings ... View more

Hey, hmm .... this is more like poking around in the dark... I'm not quite sure if wireshark comes before or after the windows firewall. another point of failure might be the windows firewall. You can try to create a new firewall-rule for incoming UDP/514. If thats not the trick you can post your inputs.conf with the data-input you've created to check if somethings going wrong there. Regards. ... View more