I have an Access List input that looks like this "|ALLOW-LABS.LOCAL\Accounting_FS_Access-0x1301ff-OI|CI|0=GenericRead|0=GenericWrite|0=GenericExecute|0=GenericAll|0=SystemSecurity|1=Synchronize|0=WriteOwner|0=WriteDAC|1=ReadControl|1=Delete|1=WriteAttributes|1=ReadAttributes|1=DeleteChild|1=Execute|1=WriteEA|1=ReadEA|1=Append|1=Write|1=Read| |ALLOW-LABS.LOCAL\FS_Admin-0x1f01ff-OI|CI|0=GenericRead|0=GenericWrite|0=GenericExecute|0=GenericAll|0=SystemSecurity|1=Synchronize|1=WriteOwner|1=WriteDAC|1=ReadControl|1=Delete|1=WriteAttributes|1=ReadAttributes|1=DeleteChild|1=Execute|1=WriteEA|1=ReadEA|1=Append|1=Write|1=Read|" This comes as one event in Splunk and anything after |ALLOW is repeated as many times as there are groups defined in the ACL (so unknown number of repeats). What I'd like to achieve is to extract and format the results in a way that groups are separated from each other. ___ROW1___ Group = LABS.LOCAL\Accounting_FS_Access GenericRead = 0 GenericWrite = 0 ... Read=1 ___ROW2___ Group = LABS.LOCAL\FS_Admin GenericRead=1 GenericWrite=1 ... Read=1 ... ___ROW7___ Group = aGroup ... I can hit the results by repeating the regex but the output is not the one desired since I'm having multiple Group fields in the event. What I'd like is for a way to separate Group1, Group2, Group3. rex max_match=99 field=ACL "\|(ALLOW-(?<Group>.*?)-\w+-\w{2}|\w{2}\|(?<SACL_Fail_GenericRead>[01])\=GenericRead\|(?<SACL_Fail_GenericWrite>[01])\=GenericWrite\|(?<SACL_Fail_GenericExecute>[01])\=GenericExecute\|(?<SACL_Fail_GenericAll>[01])\=GenericAll\|......\|ALLOW-(?<Group>.*?)-\w+-\w{2}|\w{2}\|(?<SACL_Fail_GenericRead>[01])..." Maybe I'm going the wrong way about this? I've been going around this for days. Any help would be much appreciated. ... View more

Is there any way I can load charts in a dashboard based on a verbose search? I tried saving a report with verbose which shows all the intended results but still loads in fast mode when linked to a dashboard panel. I'm using Splunk 6 Here's a search that might show the difference a bit better... eventtype=tickets assignee=aUser | convert timeformat="%Y-%m-%d %T" mktime(created_at) | fieldformat created_at=strftime(created_at,"%Y-%m-%d %T") | convert timeformat="%Y-%m-%d %T" mktime(closed_at) | fieldformat closed_at=strftime(closed_at,"%Y-%m-%d %T") | eval DaysOpen=round((now() - created_at)/3600/24,0) | eval DaysFromClose=round((now() - closed_at)/3600/24,0) | stats first(status) as status first(summary) as summary first(DaysOpen) as DaysOpen first(DaysFromClose) as DaysFromClose first(due_at) as due_at by ticket_number,assignee | search (status="open" AND DaysOpen>30) OR (status="closed" AND DaysFromClose<30) | top status returns a count of open = 18 closed = 17 searching the same thing in verbose mode returns a count of open = 18 closed = 18 The number of results for both search modes is the same until I run the last search command: search (status="open" AND DaysOpen>30) OR (status="closed" AND DaysFromClose<30) ... View more

Hi, I'm trying to setup Splunk as a trap listener via the Modular Input for some testing. My inputs.conf looks like this: [snmp://saa_traps] communitystring = public do_bulk_get = 0 ipv6 = 0 snmp_mode = traps snmp_version = 1 sourcetype = saa_traps split_bulk_output = 0 trap_host = localhost trap_port = 162 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol I can see the packet coming in through Wireshark but it doesn't get indexed. The splunkd.log doesn't indicate any issues. Not sure if related but once I get the SNMP packet from my monitored system my Splunk server sends back an ICMP reply: Destination Unreachable/Port Unreachable Any ideas? Lots of thanks ... View more

When exporting a scan to .nessus format for splunk parsing i'm missing the description field. This contains some neat info like solution, PCI references and web links. I can get that exporting to csv and then creating a lookup but maybe I'm missing something here? I'm using Nessus 5.2.5 Many thanks Costas ... View more

I've noticed that when we change or install new apps we're sometimes left with a new default directory that also shows under splunk web under apps. The name is autogenerated and looks like "default.old.20121120-143954" Is there something we're doing wrong? We mostly install apps through Splunk web. Many thanks Costas ... View more