The latest version of the Splunk Add-on for AWS has changed the JSON for the "AWS Description" ingest; see examples below. My question is about selecting values from this new 'type' of array. Before, you could select particular values with the following search syntax: tags.Name = "server1" QUESTIONS 1. How do I make the same search with the newer JSON? 2. What is the technical description for these 2 different forms of arrays? BEFORE tags: { [-]      Environment: test      Name: server1 AFTER Tags: [ [-]      { [-]        Key: Environment        Value: test      }      { [-]        Key: Name        Value: server1      } ... View more

This is really a log4net question but I'm hoping the folks here can help; I have been unsuccessful at searching online for a solution. ----------------- We have a custom application which generates local logs in JSON format via the log4net module. We then have a Splunk UF installed to collect said logs. In general that all works fine. The problem is that some log messages include a nested JSON 'message' field -- but log4net is misformatting it as a string and so Splunk doesn't parse the nested part. You can see the issue (below) where log4net is unnecessarily adding quote-marks around the nested part: CURRENT/INVALID   "message":"{"command":"Transform271ToBenefitResponse","ms":1}"   PROPER   "message":{"command":"Transform271ToBenefitResponse","ms":1}   -------------------------- I'm not entirely sure of the log4net configuration but here's what I was told by one of our developers: ORIGINAL LOG4NET CONFIG <conversionPattern value="%utcdate [%property{CorrelationId}] [%property{companyId}] [%property{userId}] [%thread] [%level] %logger - %message%newline" /> UPDATED CONFIG; STILL FAILS <conversionPattern value="{&quot;date&quot;:&quot;%date{ISO8601}&quot;, &quot;correlationId&quot;:&quot;%property{CorrelationId}&quot;, &quot;companyId&quot;:&quot;%property{companyId}&quot;, &quot;userId&quot;:&quot;%property{userId}&quot;, &quot;thread&quot;:&quot;%thread&quot;, &quot;level&quot;:&quot;%level&quot;, &quot;logger&quot;:&quot;%logger&quot;, &quot;message&quot;:&quot;%message&quot;}%newline" />                 ... View more

I am using the standard 'Splunk_TA_nix' deploy-app on all of my Linux agents. Now, we are starting to deploy Cortex XDR and the local /var/log/traps/traps.pmd log is extremely verbose and unnecessary to collect in Splunk; it's already being collected by the Cortex XDR console. How do I blacklist that one log-file without editing the original deploy-app? I have tried creating an additional deploy-app which specifies that folder, then blacklists that file, but it doesn't work. Maybe I have a typo (see below) but my suspicion is that there's a precedence issue, i.e., I can't modify the input stanza from the first deploy-app? MY NEW DEPLOY-APP's INPUT.CONF   [monitor:///var/log/traps/] blacklist = traps.pmd recursive=false disabled = false index = os sourcetype = syslog     ... View more

I have a large query which works great to search CloudTrail logs for Security Group changes. Different events, however, place the notable fields in different paths, e.g. requestParameters.groupId requestElements.groupId requestParameters.UpdateSecurityGroupRuleDescriptionsIngressRequest.GroupId In this instance, I do a series of cascading evals where I set my 'GroupID' to each path ... then do another eval that starts with 'if(isnull(GroupID)' to determine if the previous path was empty. It all works (worked) great. But now I've found another event type where the notable fields are stashed under a much longer path, e.g. requestParameters.UpdateSecurityGroupRuleDescriptionsIngressRequest.GroupId There are actually 3 paths -- for GroupId, CIDR and Description. The lookup for the GroupId works but the lookups for CIDR and Description do not. I'm doing everything the same, it just doesn't work. Are they too long? Here's an example of the CIDR query:     | spath "requestParameters" | eval CIDR = 'requestParameters.cidrIp' | eval CIDR = if( isnull(CIDR), 'requestParameters.ipPermissions.items{}.cidrIp', CIDR ) | spath "requestParameters.UpdateSecurityGroupRuleDescriptionsIngressRequest.IpPermissions{}.IpRanges.CidrIp" | eval CIDR = if( isnull(CIDR), 'requestParameters.UpdateSecurityGroupRuleDescriptionsIngressRequest.IpPermissions.items{}.IpRanges.CidrIp', CIDR )     P.S. I don't think that second 'spath' command is needed (is it?) I only threw it in when I started having trouble getting it work ...   ... View more