My situation with this error: I had established my own certs (including a CACert.pem file) and placed them in a folder: /opt/splunk/etc/auth/my_certs ... and everything worked fine, except for ldap-search it was complaining of an 'invalid CA public key file' in the SA-ldapsearch/default folder is the file ssl.conf with an entry: [sslConfig] sslVersions = tls caCertFile = cacert.pm   Well.. because my CA cert was named "CACert.pem" -- the add-on couldn't find it. I copied my CACert.pem to 'cacert.pem' -- and everything worked well again.   @jreuter_splunk wrote: sslConfig is case sensitive. Indeed it is.      Good luck.     ... View more

I'm getting the same error, though everything seems to work as expected. The GUI actually populates the config file with the management_server_ip value that Splunk doesn't like. ... View more

HI jmaple, If I correctly undertood, you need a new search having as output the total duration per day of each user? If this is your request try something like this: index=network sourcetype=cisco:asa device_name="*vpnfrw01" eventtype=cisco_vpn_* log_level=4 Username=* | dedup _time | rex "Duration: (?<h>\d+)h:(?<m>\d+)m:(?<s>\d+)s," | eval end=_time | eval start=end-duration | eval start=strftime(start, "%x %X") | eval logon = if(group="piv_group", "PIV", "RSA") | bin start span=1d | stats values(logon) AS "Logon type" values(userEmployeeType) AS "Employee Type" values(userDivision) AS Division values(userNick) AS "Account Name" values(userEmail) AS Email sum(duration) AS duration by start userIdentity | eval duration=tostring(duration,"duration") | table start userIdentity "Logon type" duration "Employee Type" Division "Account Name" Email | rename start as "Date" userIdentity as "User" duration AS "Total Session Time" | sort Date desc I don't understand why you used dedup _time . Bye. Giuseppe ... View more

Glad you found a working solution through @somesoni2! Don't forget to resolve the post by clicking Accept directly below his answer, and upvote it for helping you out 🙂 Cheers ... View more

Going on your solution, I also evaluated "now" to its own value and limited it by only showing events where the start time is > now yoursearchhere | eval start=strptime(PLANNED_START,"%Y-%m-%d %H:%M:%S.%Q") | eval boundaryDate = relative_time(now(),"+14d") | eval now=now() | where start <= boundaryDate | where start > now | table whateveryouwant ... View more

Hi, Unless user is an indexed field, you won't be able to use tstats against it. See this. If that's your case you have some alternatives: Create an indexed field for your the user field (note this won't help with old data). Create a summary index for the data you are trying to report on and use that simplified index instead If you are using Enterprise Security and your Cisco ASA logs are CIM normalised, you should be able to use one of the existing datamodels to filter by sourcetype cisco:asa and pivot by users. Quick and easy but not as accurate => If you just care about unique users and don't mind not being 100% accurate, you can also use Event Sampling (1:100 should do) and simply run something like: Unique users over time (remember to enable Event Sampling) index=yourciscoindex sourcetype=cisco:asa | stats count by user | fields - count ... View more

did you remove previous certificate in conf file? in my case i added both and error is still present ... View more

Bummer. Thanks. ... View more

Why not break it up into two lookup calls. Once for Username and then for piv base search |eval logon = if(group="piv_group", "PIV", "RSA") |eval piv=if(like(Username, "%@pivcard.com"), Username, "") |lookup ad_users identity as Username OUTPUT last AS LUserName first AS FUserName |lookup ad_users PIVAddress as piv last AS LPIVAddress first AS FPIVAddress | eval last=coalesce(LUserName, LPIVAddress) | eval first=coalesce(FUserName, FPIVAddress) |eval Nickname=last.", ".first |eval email=lower(email) |table start Username logon duration employeeType division Nickname email |rename duration as "Total Session Time" start as "Date" Nickname as "Account Name" logon as "Logon Type" division as Division email as Email Username as "Last Login Username" employeeType as "Employee Type" ... View more

Zactly. However it will make it more efficient if you mark the second capturing group as non capturing. Otherwise regex will pull it and not pull and discard it. Better to have it not use it. (in the scheme of things.) so (OID|\") becomes (?:OID|\") ... View more

The raw value did not have the newline like the event appears to in the search which is why it worked in my testing because I was using the formatting presented with the search. In any case, richgalloway solved my issue. Thanks for replying! ... View more

That works for me. Thanks. ... View more

You need the concurrency command: http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Concurrency Also, ditch the transaction command first: http://wiki.splunk.com/Virtual_.conf#March_2016 ... View more

Perfect. Thanks. ... View more

Looks like that's exactly what I was looking for. Much appreciated. ... View more

usenull=f useother=f DOES NOT WORK! Splunk is somehow pulling data with no fields. The hostname is the simplest thing in the world for it to pull yet it is determined to and blank field values for hosts. Customers did no simply forget to add the host value to their forwarders! ... View more