@bjennewein I was literally about to email you to ask about this when I originally saw your post.   I'd love to play this year!   The last few events have been a blast.   Besides, I need to know which bar Cab met Piper in?!? �   Also, I think a fun story arc would be around a flood of data, and how magical actions known as ingest modifiers allow the group to stem the flow.  ... View more

The easiest way to handle this is to create a scheduled task to run this once an hour.  Then set a filemonitor on your forwarder that will read the file and ingest it into Splunk at some point after the scheduled task.       netstat -nao| FIND "ESTABLISHED" > myestablishedconn.txt     So for example, set the scheduled task with the above command to run every hour at the top of the hour,  Then just to ensure to allow time for latency and such set the splunk configuration to monitor that file for ingestion.   I'll let you decide how to handle the file, either delete it (if it exists at the begin of each run, by adding a del filename at the beginning of the scheduled task, otherwise ensure when you create the input that you salt the file).      Here is the page from documentation discussing file monitoring in greater detail.    https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories   I hope this helps!   Happy Splunking!! Dustin   ... View more

I ask about the region, because here on the support page (https://docs.splunk.com/Documentation/AddOns/released/AWS/Config) for the add-on which speaks about doing the exact install you wish, including going from AWS Config --> SQS S3, at the top of the page there is a link which specifically notes that the function has limitations based on the region in which the services are located, specific to Config Inputs. ... View more

Also, what AWS regions are your data residing in that you are seeing this? I've found a support article that indicates there are some restrictions on Configuration Rules based on the region in which the AWS instance resides. Also, if you search sourcetype=aws:config:rule do you get any results? ... View more

What version of the App are you running? Just so I can make sure I'm not speaking on anything in the newer version which may not be in a version you are using. Also, was this a new install? Or an upgrade? -Dustin ... View more

Given that your prior experience from mimecast direct integration was messy, would it be possible to just dump a raw logset from mimecast on a regular interval and have those ingested into Splunk. Then you could write a custom field transformation based on the output of those logs, and use that to then make a field extraction to add to any external e-mails in your message tracking searches. Or was this possibly what you had tried before? I have not worked directly with mimecast, but after reading your use case and the other comments this was my first thought on how I might approach the situation. Then perhaps if you have those mimecast logs and could include appropriately redacted logs the community may be able to assist with transformations and such if that is where things got sticky. -Dustin ... View more

Rich, Thank you for your insight and answer on this matter. I agree the DB is rather messy. We are going to pursue the DB Connect option possibly. Otherwise, we may forgo ingesting this unless required, as the DPA interface seems to work just fine. ... View more

Giuseppe, I think this query you have provided will definately provide what I"m looking for. However, In practice it is not working so I'm including my literal search string, modifying some specific names for anonymity index = myindex eventtype = windows_logon_success user!=*$ user!=- user!=*App* user!=*Svc* user!=SYSTEM | stats count by Account_Name | append [ | inputlookup ApprovedUsers.csv | eval count=0 | rename SamAccountName as Account_Name| fields Account_Name count] | stats sum(count) AS total by Account_Name | where total=0 | eval Status "In lookup, not in logs" | append [ search (index = myindex eventtype = windows_logon_success user!=*$ user!=- user!=*App* user!=*Svc* user!=SYSTEM) NOT [ | inputlookup ApprovedUsers.csv | rename SamAccountName as Account_Name| fields Account_Name ] | eval Status "In logs, not in lookup" | table _time Account_Name ] | table Account_Name Status ... View more

Per Feedback from my End User in this case: I would be interested in having an average of CPU and memory in use every five minutes and every hour. I asked for further clarification and they users wants simply an average of CPU utilization over a 5 minute window, or over a 1 hour window/host. I hope this helps clarify the use case. ... View more

<form> <label>My Event Timeline</label> <fieldset submitButton="true"> <input type="time" token="time"> <label></label> <default> <earliest>-4h@m</earliest> <latest>now</latest> </default> </input> <input type="text" token="host" searchWhenChanged="false"> <default>*</default> <initialValue>*</initialValue> <prefix>host=</prefix> </input> <input type="text" token="user" searchWhenChanged="false"> <label>User</label> <default>*</default> <initialValue>*</initialValue> <prefix>user=</prefix> </input> <input type="checkbox" token="authentication"> <label>Authentication</label> <choice value="eventtype=windows_logon_success">Login</choice> <choice value="eventtype=windows_logoff">Logoff</choice> <delimiter> OR </delimiter> </input> <input type="radio" token="execution" searchWhenChanged="true"> <label>Execution</label> <choice value="myindex1">Powershell</choice> <choice value="myindex2">Command Line</choice> <prefix>index=</prefix> </input> <input type="radio" token="configuration" searchWhenChanged="true"> <label>Configuration</label> <choice value="sourcetype=log_config_audit">Log Config</choice> <choice value="New_Process_Name=msiexec.exe OR New_Process_Name=TrustedInstaller.exe">Installs</choice> </input> <input type="checkbox" token="EventType"> <choice value="LogName=Application">Application</choice> <choice value="LogName=System">System</choice> <choice value="LogName=Security">Security</choice> <delimiter> AND </delimiter> <default>LogName=Security</default> </input> </fieldset> <row> <panel> <table> <title>Results</title> <search> <query>$execution$ $host$ $user$ |eval moresearch=if($execution$="index=myindex1"," ", (($authentication$)" OR ".($configuration$)" OR "($EventType$)))| search moresearch</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more

Current Search String. $execution$ $host$ $user$ |eval moresearch=if($execution$="index=myindex"," ", (($authentication$) OR ($configuration$) OR ($EventType$)))| search moresearch ... View more

When I do this and do not surround the token name, in my case execution, in $ it does't appear to actually do the if validation..... as it seems to just put the name of the token in execution rather than the value of the token (as I've written it into the search as execution=.....) when I wrote it in as $execution$=.... it would pass the proper value, but would throw an error that the eval statement was malformed. I get the following back from the inspector, in my current form of the search: search index=myindex host=* user=* | eval moresearch=if(execution="index=myindex2"," ", ((eventtype=windows_logon_success) OR (New_Process_Name=msiexec.exe OR New_Process_Name=TrustedInstaller.exe) OR (LogName=Security))) | search moresearch ... View more

Unfortunately no, that simply makes my dashboard wait for additional input, so it would appear that it believes the s$ is another input token, and is waiting for input, but I have no way to enter input for it. ... View more

However, the issue is that the $execution$ token that gets set, the entire value of the token is index=index1 so $execution$=index=index1. So do I perhaps need to put the =index1 in single quotes? so that it will read index=index1 as a string rather than a comparison? Thanks! Dustin ... View more

DalJeanis, Thank you for your response. However, this search yielded no results at all. It did not return the users NOT in the list which logged on, but it also did not provide any information about the approved users. But the goal of this is to look at the Approved user list and compare that to the 'successful logon events' and if the Account_Name is NOT in the list then I need it to count that or create it as a search result that I can count/return, and then use that to alert against. Thanks! Dustin ... View more

Giuseppe, First I want to thank you for your response! I did attempt this search, and the issue at hand is that it returns all of the entries in my csv file showing a count of 0 (indicating these users have not logged on). As soon as I then initiate a logon with one of the users, that entry is removed from the search (as would be expected). However, what I'm trying to determine is when anyone EXCEPT the entries in the csv logon. I.e. If user abc is in file and logons that's fine. But then if user xyz logs on, and is not an entry in the CSV I need the search to return that user xyz logged on. And I need it to alert anytime a user NOT in the list logs on. But right now I'm just focused on getting the search right, the alert portion is simple once I get the search to return properly. Any other suggestions? ... View more