@sarwshai  Can you please try this? Here I have considered below IP ranges as private IP ranges. Private IP addresses: 10.0.0.0 to 10.255.255.255 172.16.0.0 to 172.31.255.255 192.168.0.0 to 192.168.255.255   YOUR_SEARCH | rex field=src_ip "(?<src_range_1>[0-9]{1,3}).(?<src_range_2>[0-9]{1,3}).[0-9]{1,3}." | rex field=dest_ip "(?<dest_range_1>[0-9]{1,3}).(?<dest_range_2>[0-9]{1,3}).[0-9]{1,3}." | table src_ip dest_ip count src_range* dest_range_1 dest_range_2 | eval is_valid_ip = case( src_range_1="10" and src_range_1=dest_range_1,"0", src_range_1="192" and src_range_1=dest_range_1,"0", src_range_1="172" and src_range_1=dest_range_1 and src_range_2>15 and dest_range_2<32,"0", 1==1,"1") | where is_valid_ip="1" | table src_ip dest_ip count   My Sample Search : | makeresults | eval _raw="src_ip dest_ip count 10.0.0.1 10.10.0.1 1 10.0.0.1 192.168.0.1 1 10.0.0.1 10.10.0.1 1 10.0.0.1 10.10.0.1 1 172.16.0.0 172.31.255.255 1 192.168.0.0 192.168.255.255 1 10.0.0.1 10.10.0.1 1 " | multikv forceheader=1 | rex field=src_ip "(?<src_range_1>[0-9]{1,3}).(?<src_range_2>[0-9]{1,3}).[0-9]{1,3}." | rex field=dest_ip "(?<dest_range_1>[0-9]{1,3}).(?<dest_range_2>[0-9]{1,3}).[0-9]{1,3}." | table src_ip dest_ip count src_range* dest_range_1 dest_range_2 | eval is_valid_ip = case( src_range_1="10" and src_range_1=dest_range_1,"0", src_range_1="192" and src_range_1=dest_range_1,"0", src_range_1="172" and src_range_1=dest_range_1 and src_range_2>15 and dest_range_2<32,"0", 1==1,"1") | where is_valid_ip="1" | table src_ip dest_ip count   Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.  ... View more

Can someone help me with the steps that needs to be taken at configuration at Isilon source end and details that i need to co? I have installed the add-on on the forwarder and search head and got stuck with the configuration.   ... View more

Hi @sarwshai, You're welcome! if this answer solves your need, please accept it for the other people of Community. Ciao and next time. Giuseppe ... View more

See https://docs.splunk.com/Documentation/Splunk/8.0.2/Installation/AboutupgradingREADTHISFIRST Beyond that, follow the instructions you have. Upgrade apps first, unless they require Splunk 8.x; upgrade those apps after upgrading Splunk. ... View more

Thanks @woodcock ... View more

I don't like it! but if you cannot use a dedicated server (better!). Ciao. Giuseppe ... View more

Try experimenting with the maxpause option of transaction . It will create separate transactions if the gap between events is large enough. ... View more

Hi. If you want to avoid alot of error messages, or if you are migrating. I would start with UFs and HF data. Then Cluster in maintane mode followed by shutting down indexers, Cluster master,. Then in the end search heads and deploymentservers (even if you can start with them aswell) When starting up the environment, do it in reverse. Cluster master, indexer, searchhead, deploymentserver and start to onboard data. ... View more

I'd start by checking which are the sourcetypes that are being badly distributed between the two sites. What about connectivity between the log sources and each of the sites? ... View more

Yes ** for the bold, my bad! and structure is same as i pasted above. ... View more

Your query is using join when it shouldn't the correct use for this is as I suggested. Note this is lookup, not inputlookup: index=myindex "searchterm" [| inputlookup "mylookup.csv" | fields src_ip] |stats values(field1) values(field2) by src_ip |lookup mylookup.csv src_ip ... View more

If/when there is an official response, it will appear on: https://www.splunk.com/page/securityportal/ UPDATE official response: https://www.splunk.com/view/SP-CAAAP5E As of Splunk 6.6 that endpoint requires authentication: http://docs.splunk.com/Documentation/Splunk/6.6.0/Installation/Aboutupgradingto6.6READTHISFIRST#Protection_for_the_.27.2Fserver.2Finfo.27_REST_endpoint_is_now_on_by_default As far as the "license keys" that are exposed, I don't know much about this endpoint, but to my untrained eye they look like they're hashes of the license files. (An actual license is a signed XML file, for example see this expired license used as part of tests for the Java SDK: https://github.com/splunk/splunk-sdk-java/blob/master/tests/com/splunk/splunk_at_least_cupcake.license ) REST Endpoint Description: http://docs.splunk.com/Documentation/Splunk/7.1.1/RESTREF/RESTintrospect#server.2Finfo ... View more

Click Accept on your answer here to close the question. ... View more

Hi sarwshai, I think you might need to look at custom alert actions for this case. http://docs.splunk.com/Documentation/Splunk/7.0.2/AdvancedDev/ModAlertsIntro Heavy scripting ahead. IMO. ... View more

Think in terms of stages, and add up the information for each stage independently before you go on. At its lowest level, you need a search that finds lockouts. At the next level, you need them added up by day. At the next level, you need to know how many days passed/failed your criteria.. (your search that gets the individual lockout records for the days ) | rename COMMENT as "bin them by day and count how many for each user for each day" | bin _time span=1d | stats count as lockouts by UserName _time | rename COMMENT as "Get rid of days with less than 5 " | where lockouts >= 5 | rename COMMENT as "Find out how many days have 5 or more" | stats count as daysover5 values(_time) as times max(_time) as _time by UserName | rename COMMENT as "Get rid of users with less than 3 " | where daysover5 > = 3 ... View more

Yes tried finding to send monitoring console overview as a pdf but there isn't any options, yes we have different email alerts created for our cluster but just wanted the PDF, anyways thanks. ... View more

The suggestion mentioned above did not work for me. I had to do the following: 1) I found it necessary to edit the read-audit-logs_2010_2013.ps1 and the read-mailbox-audit-logs_2010_2013.ps1 scripts with $SessionUri = "http://" + ([System.Net.Dns]::GetHostByName(($env:computerName))).Hostname + "/Powershell/" $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri $SessionUri -Authentication Kerberos Import-PSSession $Session -AllowClobber # Add the remove session to the end of the script Remove-PSSession $Session 2) I could not write to logs nor access various logs, so found it necessary to add the service account running splunk to the Exchange Server Administrators group. 3) Found in the splunkd.log "Get-InboxRule : You must provide a value for this property". Adding a mailbox to the service account fixed this issue. 4) Found in the splunkd.log "Get-MailboxStatistics : Failed to commit the change on object "dbname" because access is denied." Adding the service account to View Only Administrators was not enough. I had to add the service account to Exchange Organization Admins. Now that this is working I will need to pare back some rights as I do not like service accounts with so many permissions in my environment. ... View more

Hi @sarwshai - its not about where (in the world) your forwarders are. Its about where your firewall is. The reason for this, is that we should assume that the time on the firewall is right... That is to say, a fw in the UK will use UK time, and one in Sydney is in AEST. That's why you need to set your sourcetype to use the TZ of the source data. So. the first question is therefore "where is your firewall located?" ... View more

Cisco Security Suite was tested on Splunk 6.5.x, 6.6.x and 7.0 and it works fine. ... View more

I think you meant splunk cmd btool indexes list wineventlog --debug 🙂 ... View more

I dont believe there is a good way. Also their are other transfers happening such as bundle replication. Though the search below may help. `dmc_set_index_introspection` host=your search head sourcetype=splunk_resource_usage data.search_props.sid::* | stats max(data.written_mb) as mbWritten last(_time) as _time by data.search_props.sid | bucket _time span=1m | stats sum(mbWritten) as mbWrittenBySearch by _time ... View more

but even so, the documentation here is one of the worst, I would almoast say contradictory: 1.prioritize current data VS data completion, what would one be supposed to understand from such abstract terms 2.As excessive failed logins matter most when you hear about them quickly VS If you care more about identifying all excessive failed logins in your environment -again what is the differnce between this two statememts? might be because I am not native english speaker,but I am not so sure is my fault ” Configure a schedule for the correlation search Correlation searches can run with a real-time or continuous schedule. • Use a real-time schedule to prioritize current data and performance. Searches with a real-time schedule are skipped if the search cannot be 11 run at the scheduled time. Searches with a real-time schedule do not backfill gaps in data that occur if the search is skipped. • Use a continuous schedule to prioritize data completion, as searches with a continuous schedule are never skipped. As excessive failed logins matter most when you hear about them quickly, select a real-time schedule for the search. If you care more about identifying all excessive failed logins in your environment, you can select a continuous schedule for the search instead. ” ... View more