Hi, I'm sending logs from Windows machines to a log group in CloudWatch that sends to Splunk via Lambda function. These logs are arriving in Splunk in the wineventlog sourcetype, but the parse is not correct. In the raw source logs, I can view that the logs come in one line, and differently than the parse understands. Example: [Security] [4776] [Microsoft-Windows-Security-Auditing] [XXXXX] [The computer attempted to validate the credentials for an account. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: 000000 Source Workstation: CBBBB Error Code: 0x0] I've tried to change the sourcetype, the format to CSV, deleted the line_breaker, but until now it does not work. Does anyone know how I can parse these kinds of logs coming from log groups in AWS CloudWatch? Thank you a lot.  ... View more

Guys, I'm trying to set up Guardduty log collection, but so far I'm not successful. I have a heavy forwarder that forwards logs to the indexer and the search head queries the data in the indexer. I configured the add-ons on the necessary platforms (heavy forwarder and search head), I configured the accounts needed to forward the logs. The logs are being sent via the SQS queue. The logs arrive at the indexer, but I can't get the dashboard populated (Splunk App for AWS and aws_guardduty). On the dashboards, in the 'AccountID' menu, a message appears "Search produced no results." I also tried to configure via HEC, but there is an error message that it cannot connect to the platform. Can someone help me? ... View more

Guys, I have the query with index=te*. I need this search in this form. I cannot change for separated index. my search is: index=te* source=Win* OR source=win* user=Admin* NOT user=*$ EventCode=4625 OR EventCode=4624 | table index _time user src host src_ip name I need to filter a user=Administrator that appears in just one of these indexes. How can I do that? Thanks. ... View more

Dear, I configured the inputs.conf of the palo alto app exactly as the documentation. However, in addition to the palo alto logs, I get other logs via udp: 514. The configuration in inputs.conf is forwarding all logs via 514 to the pan: log sourcetype. How could I change only the high-pit logs to the sourcetype pan: log? ... View more

Guys. I have many Universal Forwarders installed in the machines that send logs to one Heavy Forwarder. This Heavy Forwarder sends log to my indexer. I do not know why each universal forwarder is sending its own internal logs (splunkd, metrics, etc) and indexing this data. I do not want the internal logs from each universal forwarder. I've tried to filter these logs in the heavy forwarder, but it's not working. What can I do? Thanks. ... View more

Dears, I'm trying to use a lookup for Splunk to read a file and tell me if I'm collecting the logs to the host of that file. What I need: Check if I'm getting logs from hosts that are in a CSV. I am using the following query: index = main OR index = client * | stats count by host | lookup client_sys hostname AS host I also tried using the inputlookup command, but it did not work: index = main OR index = client * NOT [| inputlookup client_sys.csv | fields host] Is there any other way to do this? Thanks a lot. ... View more

Hi Guys. I need help with Splunk Db Connect error. I configured the splunk db connect with the following parameters. The firewall rule is enabled, telnet port 1521 is working, ping is working, I've configured the Drivers and JAVA_HOME correctly (no error shows) BUT when I tried to establish connection, the following error appear for me. I don't have any idea whats going on. Anyone could clarify for me? ... View more

Dear, I'm getting CEF type logs, but Splunk is not parsing correctly. I installed the App Splunk App for CEF, but it does not work. I also installed the CEF Extraction Add-on for Splunk app but it is not working either. I tried parsing in the indexer by props.conf and transforms.conf, but it did not work: props.conf [host :: XXXXX] EXTRACT-cef-message = CEF transforms.conf [CEF] REGEX = \ d \ | (? [^ \ |] +) \ | (< [^ \ |] +) \ | (<< vendor_severity> [^ \ |] + (\ \ Ssquc \ srequestCookies \ = (\ S +) \, \ siPlanetDirectoryPro \, \ sJSESSIONID = (\ S +) \ srequest \ \ scs \ w \ s \ w \ s \ w \ s \ w \ s \ w \ w \ w \ w \ w \ w \ w \ w \ s] +) \ scs \ w + Label \ +) \ scs \ w + \ = ([\ w \ s] +) \ scs \ w + \ = ([\ w \ s] +) \ s DEST_KEY = MetaData: Host Splunk is doing the parse as follows: aact aamlbcookie acat cn1 acn1Label cn5 acn5Label acs1 acs1Label acs2 acs2Label acs3 acs3Label acs4 acs4Label acs5 acs5Label acs6 acs6Label date_hour date_mday date_minute adate_month date_second adate_wday date_year date_zone end aeventtype ahost aindex aiPlanetDirectoryPro aJSESSIONID linecount amsg aprimefaces_download apunct areason arequest arequestCookies arequestMethod asource asourcetype asplunk_server asplunk_server_group asrc asuser timeendpos timestartpos Can someone help me? ... View more

Hi guys, I have to configure the timespan to roll data to warm, cold and frozen. The question is: How can configure timespan to roll from hot to warm? And from warm to cold? And from cold to frozen? This configurations must be done in each index in indexes.conf ? I read the http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Configureindexstorage and http://docs.splunk.com/Documentation/Splunk/6.5.2/admin/Indexesconf document but I only found frozenTimePeriodInSecs not like "hotTimePeriodInSecs" Thank you so much guys! ... View more

Hi guys. Anyone knows why, when I search the splunk resource usage via REST, the date was incorrect. My monitor console dashboards doesn't show anything because of this, I guess. Tks in advance. ... View more

Hi guys, My monitor console does not show any memory and CPU data. Just the disk usage dashboard is showing. When I run the search individually, does not show any | rest results. I've already checked _introspection, splunk_monitoring_console etc. When I curl the '/services/server/status/resource-usage' any data shows for me. Any ideas? Tks a lot. ... View more

Hi Guys, There's any query in the splunk web that I'm able to see if the splunkd is not running in a forwarder? Tks. ... View more

Hi everyone. I've been searching on other 'answers' but no one have solved my problem. I have some alerts that, depending on the conditions, send an email with details of the incident. It's been a few days that I'm not receiving any email from Splunk. I forced the alert situation and it did not send any email. The alert also is not appearing in the triggered alerts. When I run the search, the results are shown. I have already checked the following settings: alert_actions.conf a query 'ex = _internal source = * scheduler.log' I forced the sending of an email by the search: index = _internal | head 1 | sendemail to = "name@my.email.domain" format = "html" server = smtp.gmail.com: 587 use_tls = 1 and it sends the email. Does anyone have other tips to investigate? Tks so much. ... View more