I would like to run a search on my logs so they detect fuzzy like strings. So in my current example we received a phishing e-mail with the string "ADP Past Due Invoice#{00000000}" with random numbers where there are zeros. I turns out in this case it is easy to search because I can just leave the number off the search, but I would like to group like "subjects" no matter what the pattern is, and then dig deeper from there. So for example, what if the string was "hello {user} your file is attached" I would like a search that would group all the subjects so I can see that there were say 100 of these type of messages being set to 100 unique users. Is that possible? ... View more

After I upgraded from 6.1.3 to 6.2, my Splunk login page no longer allows me to log in using chrome + keepass. What happens is, the username and password are retrieved from keepass, and inserted into the login screen, but it returns the error "Invalid username or password." Looking under the covers it seems that although the web page shows the proper credentials being populated, when I performed a packet capture and looked inside it actually does not send the username or password values, as below: POST /en-US/account/login HTTP/1.1 cval=2021369897&username=&password=&return_to=%2Fen-US%2F If I type the information in by hand it does, it does send the username and password, as in this example: POST /en-US/account/login HTTP/1.1 cval=2021369897&username=admin&password={password}&return_to=%2Fen-US%2F&set_has_logged_in=false So I am figuring that something broke in the version change. ... View more

Starting with the data in an event: Lines in Single Event: PosTransactionProperties[1].PosTransactionPropertyCode[1]=RECEIPT_EMAIL_ADDRESS PosTransactionProperties[1].PosTransactionPropertyValue[1]=user-email@domain.com PosTransactionProperties[2].PosTransactionPropertyCode[1]=RECEIPT_DELIVERY_METHOD PosTransactionProperties[2].PosTransactionPropertyValue[1]=EMAIL+PAPER PosTransactionProperties[3].PosTransactionPropertyCode[1]=CUSTOMER_EMAIL_UPDATED PosTransactionProperties[3].PosTransactionPropertyValue[1]=true I would like to create fields and values that look like the following for all events: RECEIPT_EMAIL_ADDRESS = user-email@domain.com RECEIPT_DELIVERY_METHOD = EMAIL+PAPER CUSTOMER_EMAIL_UPDATED = true I am taking a three (3) step process to achieving my goal: (Still having issues on Step 3) Extract the initial values from the original lines as multi-valued values Combine the values in a single field Break that field into parts, that will create the new field=values format I am desiring Step 1 - I did this by extracting the fields using some multivalue field extractions in props.conf and transforms.conf, putting them into two fields (postransactionproperties_PosTransactionPropertyCode and postransactionproperties_PosTransactionPropertyValue) props.conf REPORT-trans_PosTransactionProperties = t_PTP_PosTransactionPropertyCode, t_PTP_PosTransactionPropertyValue transforms.conf # =-=- PosTransactionProperties[1].PosTransactionPropertyCode[1]=RECEIPT_EMAIL_ADDRESS [t_PTP_PosTransactionPropertyCode] REGEX = PosTransactionProperties\[[0-9]+\]\.PosTransactionPropertyCode\[[0-9]+\]\=([^\n]+)\n FORMAT = postransactionproperties_PosTransactionPropertyCode::$1 MV_ADD = true REPEAT_MATCH = true # =-=- PosTransactionProperties[1].PosTransactionPropertyValue[1]=user-email@domain.com [t_PTP_PosTransactionPropertyValue] REGEX = PosTransactionProperties\[[0-9]+\]\.PosTransactionPropertyValue\[[0-9]+\]\=([^\n]+)\n FORMAT = postransactionproperties_PosTransactionPropertyValue::$1 MV_ADD = true REPEAT_MATCH = true I then end up with the two mvfields, with all the values lines up in the order they show up in the event. postransactionproperties_PosTransactionPropertyCode RECEIPT_EMAIL_ADDRESS RECEIPT_DELIVERY_METHOD CUSTOMER_EMAIL_UPDATED postransactionproperties_PosTransactionPropertyValue user-email@domain.com EMAIL+PAPER true Step 2 - I then combine the two fields in the order they exist, into a single field matching the values up together, with a separator using an eval statement in the props.conf file props.conf EVAL-glue = mvzip(postransactionproperties_PosTransactionPropertyCode,postransactionproperties_PosTransactionPropertyValue,":::") The result is a field named 'glue' that has values as such: CUSTOMER_EMAIL_UPDATED:::true RECEIPT_DELIVERY_METHOD:::EMAIL+PAPER RECEIPT_EMAIL_ADDRESS:::user-email@domain.com Step 3 - Which I am having trouble with, I want to now break the values of the field 'glue' up into Key => Value pairs. I am thinking I can do this again with a props.conf and a transforms.conf statement as such: props.conf REPORT-trans_glue = t_unglue transforms.conf [t_unglue] SOURCE_KEY = glue REGEX = ([a-zA-Z0-9\_\-]+):::([a-zA-Z0-9]+) FORMAT = $1::$2 This unfortunately does not work at all, and I need a little help to either understand why, and how to get it to work, or attack this whole problem in a different fashion all together. (NOTE: I understand the REGEX statement is not 100% correct, but it should have at least matched the 'true' result and it does not). Thank you ... View more

I have 4 indexers in a cluster, that I need to upgrade the disk to gain more storage. All systems are Linux Each server in the cluster has an /app mount for splunk (/app/splunk/...) Each /app mount is 6TB of space with 4TB usable as RAID 6 I need to pull the existing drives, and replace them with larger drives to get more storage. The question is around what the best process is for the migration strategy: Option 1) Back up the existing 4TB of data, Pull the existing disks, Replace with new larger disks, Rebuild the array on the new disks (16TB), Restore the files back to the new array, Let cluster re-sync, Repeat process for the other 3 servers. Option 2) Pull the 4TB Raid Array, Install the new drives and configure RAID 16TB, and let the cluster rebuild what is missing, Once all the systems are Synced, Repeat process for other 3 servers. The real question is, If you were to loose a whole server in an Index Cluster (On accident or on Purpose), would you loose 1/4 of the of the data, or would it get re-created once you rebuild the servers let the servers replicate things. This is making the assumption that we do NOT have a backup. I ask the question, because I know in a cluster, some of the buckets get marked as Primary, and Secondary bucket. Thanks ... View more

I would like to take the following lines in my props.conf file, and at Search Time, use these Field Extractions to Set a fixed value for a new field depending on the rule that it hits: [safenet_datasecure] EXTRACT-datasecure0 = Web login failure\: Invalid username\/password in login attempt for administrator \"(?<ing_user>[a-zA-Z0-9]+)\" from (?<ing_clientip>[0-9]+.[0-9]+.[0-9]+.[0-9]+) EXTRACT-datasecure1 = Login attempted with invalid username \"(?<ing_user>[a-zA-Z0-9]+)\" So I get a field like ing_rule=0 or ing__rule=1 depending on if it used datasecure0 or datasecure1 to extract the field from the event. Anyone? ... View more