How set several request in one input ? I must first authenticate to the REST API, then pass the query, and at end close the session Regards ... View more

Hi I installed this app on Splunk 6.5 and i have no editor is it compatible with 6.5 ... View more

Hi All I work with Hunk 6.4 and I have an error message in splunkd.log when a Data Model is accelerating. ERROR TsidxStats - sid:summarize_1461858016.310 Failed to contact the server endpoint https://127.0.0.1:8089 from touchSummary() Please someone could help me ? Regards ... View more

I have two types of people that need to access the same data source, but one of them must access anonymized data. I have created two applications and I tried to force the sourcetype in props.conf and transforms.conf, but Splunk merged both and only one transform is applied. Props.conf First App : [source::.../user/haddadm/share/hls/commun/data/reception/access/env=homo/*/*/*] TRANSFORMS-sourcetype = source1 Second App : [source::.../user/haddadm/share/hls/commun/data/reception/access/env=homo/*/*/*] TRANSFORMS-sourcetype2 = source2 Transforms : First App : [source2] DEST_KEY = MetaData:Sourcetype REGEX = .* FORMAT = sourcetype::access2 Second App: [source2] DEST_KEY = MetaData:Sourcetype REGEX = .* FORMAT = sourcetype::access2 Can someone help me? ... View more

Hi All this is my data on one transaction Nov 4 13:55:51 10.236.33.22 Nov 4 13:55:51 LPD-ZF5-001 notice tmm3[19702]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK Nov 4 14:51:20 10.236.33.22 Nov 4 14:51:20 LPD-ZF5-001 notice tmm[19699]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK Nov 4 14:51:33 10.236.33.22 Nov 4 14:51:33 LPD-ZF5-001 notice tmm2[19701]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK Nov 4 15:29:17 10.236.33.22 Nov 4 15:29:17 LPD-ZF5-001 notice tmm3[19702]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK Nov 4 15:29:26 10.236.33.22 Nov 4 15:29:26 LPD-ZF5-001 notice tmm[19699]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK Nov 4 15:29:33 10.236.33.22 Nov 4 15:29:33 LPD-ZF5-001 notice tmm2[19701]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK i defined eventtype who match each line and when i try to calculate the occurrence of the eventtype i have always 1 So how calculate the occurrence of this eventtype ? Regards Tony ... View more

Hi i uploaded this new release cause i 'have some troubles with the older to user FIELDS parameter in fw1-loggrabber.conf i put this setting in the conf file to reteive only three fields FIELDS="orig;src;dst" this is the result : loc=16949145|time=11Sep2013 11:41:52|action=drop => we have correctly three fields but not i asked if i modifie the setting like this : FIELDS="service;s_port;proto" this is the result : loc=17061123|time=11Sep2013 11:44:58|action=accept i conclude this option is not running correctly someone watch it ? Thanks ... View more

Hi i'm using this app and i have some trouble to reduce the indexed volume i will reduce the flow selecting only some fields : i modified the file fw1-loggrabber.conf : FIELDS="time;action;src;s_port;dst;service" but it's not working : flow not contain selected fields "loc=109418|time=18Jul2013 10:30:54|action=accept|orig=10.127.**|i/f_dir=inbound|i/f_name=bond1.206" when i reset config file i receive all fields "loc=5384|time=18Jul2013 5:59:59|action=accept|orig=10.127.**|i/f_dir=inbound|i/f_name=Exp1-2|has_accounting=0|uuid=<51e7683f,00000004,11017f0a,0005ffff>|product=VPN-1 & FireWall-1|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={66154744-EF02-11E2-936D-000000005656};mgmt;date=1374080435;policy_name=INTE]|rule=12|rule_uid={131EB010--AA76-1DE2C9866C7B}|service_id=TCP-9505|src=10.156.4.10|s_port=2110|dst=10.176.253.182|service=9505|proto=tcp" i read someone use old binary version 2.0.1 to solve this issue where can i download the older version 2.0.1 ? someone have got any other solution ? Thanks ... View more