Our environment consists of a multi-site indexer cluster, two search head clusters, and several thousand Windows hosts. Our current implementation of the Splunk_TA_windows app is a bit of a mess, with different versions on the search heads, indexers, and UF's. I'd like to get everything standardized by upgrading to the latest version, as well as testing out XML format for WinEventLogs, however many of these hosts do not meet the minimum requirements for the Splunk_TA_windows v6 (Windows 2003 and 2008 servers, as well as some pre-6.6 Splunk UF's although we can get these upgraded). I was considering a separate server class for the UF's that are supported,including a renamed version of the app, however I'm not sure how to handle the indexers and search heads. If we leave the current version (4.8.3) on the indexers, then the index-time extractions will be applied to both v6 and pre-6 hosts, which I imagine would cause problems. The same hold true if we upgrade the app on the indexers - the servers running the older version of the app will have the props/transforms settings from the new version applied. One thought I've been toying around with is sending the servers that support v6 through our heavy forwarders and installing the newer version of the app there. The legacy servers would keep v4 or 5 as would the indexers, newer servers would get v6 as would the HF's. Even if that works though we still have the search-time extractions to deal with on the two search head clusters, and I'm not certain that either version is compatible with the other. Has anyone else run into this? Is there a solution where I can support both the latest version of the Windows app on newer servers as well as the older version, or am I stuck waiting for all of our legacy servers to be phased out? ... View more

We are using the Palo Alto TA and pushing the default app to our search head cluster. In props.conf there is an automatic lookup which references a KV store that is empty, causing errors when searching that data source on the search heads: LOOKUP-minemeldfeeds_src_lookup = minemeldfeeds_lookup indicator AS src_ip OUTPUT value.autofocus_tags AS src_autofocus_tags I've tried creating the same stanza in local/props.conf on the deployer without specifying the lookup but that just brings additional errors: LOOKUP-minemeldfeeds_src_lookup = We don't plan on using the minemeldfeeds so I don't see a need for this automatic lookup. Other than remarking the line in default, how would we disable a default setting in an app on the search heads? ... View more

I'm looking to put together some reports on vulnerability data where I can show a trending value of both fixed and active vulns at any given time. Our vulnerability data is separated where we have assets (asset_id) and the last time they were scanned (last_scan_finished) as one sourcetype, and the assets (asset_id), vulnerability (signature_id) and the last time that vuln was detected (most_recently_discovered) as another sourcetype. When a vulnerability is resolved we don't receive any indication in the data, but it will not be detected in future scans. I'm looking to timechart each combination of asset_id and signature_id, where if the most_recently_discovered field is greater than or equal to the last_scan_finished date it is considered active, otherwise it's resolved. I've made several attempts however haven't been able to come up with a workable solution. Any help would be greatly appreciated. ... View more

I'm trying to extract the field values from a CSV file where the delimiter is a comma and most field values are contained within single-quotes/apostrophes such as this: 2018-06-19T12:15:24Z,Success,'MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@abc.com','<4c0dc4ce-a96b-4121-8170-b9e4bbd79baa@hq.abc.com>','ReportItem',40451,+2018-06-19T12:00:10:000+00:00-UTC,'ExpressServices@abc.com',+2018-06-19T12:00:10:000+00:00-UTC,'Undeliverable: Trigger Pending Files in PROD' This works for 99% of the events, however some events have a single-quoted value within another single-quoted value, such as the event below: 2018-06-19T12:15:25Z,Success,'MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@abc.com','<9d5f7114-a2f5-4121-ba3f-dfdeea818a56@PCMEX04.hq.abc.com>','ReportItem',173809,+2018-06-19T12:00:11:000+00:00-UTC,'user@abc.com',+2018-06-19T12:00:11:000+00:00-UTC,'Undeliverable: 'Daily Unmatched Check Report'' For whatever reason this is preventing the line break for this event, causing it to merge with the following line. I'm using the following props.conf settings for the sourcetype but can't get these events extracted correctly or prevent the linemerge from happening. DATETIME_CONFIG = HEADER_FIELD_LINE_NUMBER = 2 INDEXED_EXTRACTIONS = csv LINE_BREAKER = ([\r\n]+) KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true FIELD_DELIMITER = , FIELD_QUOTE = ' TIMESTAMP_FIELDS = legacyxmlemail_receivedate BREAK_ONLY_BEFORE = ([\r\n]+) ... View more

Let's say an app ships with one or more default CSV lookup tables. You want to add additional data to these lookups so you modify the CSV (manual edit, not through any search function). The next app update will then overwrite the modified CSV file. What would be the best practice regarding modifying lookup files that ship with an app? Clone the file and then modify that? Move it to a default app and then update the transforms.conf? ... View more

We are looking to convert most if not all of our existing searches and correlation rules to search against accelerated data models. Is there a way to get event/streamstats to work with tstats? ... View more

So after months of battling an issue with our indexers dropping connections, we determined that there was a problem with the indexers performing reverse DNS lookups for the connecting servers. To mitigate, we added 'connection_host = none' to the inputs.conf resolving the issue. If I understand how the host field in the indexed events is populated correctly, with 'connection_host = none' set on the indexers we will now rely on the 'host = ' field in inputs.conf on the UF's. I know this value is automatically populated with the server name when Splunk is first installed, however what happens if a server is renamed? Will it modify the inputs.conf to replace the 'host =' field with the new server name? ... View more

I've created two accelerated data models. As admin, I can search each of them with |tstats summariesonly=t FROM datamodel=yadayadayada , however, as a non-admin user, I can only search one of the two. If I remove summariesonly=t from the search, they are both accessible, however, for the one that's not working when I include summariesonly=t , I get no results. I've checked the local.meta and both data models have the same permissions. Nothing of value in the _internal and _audit logs that I can find. Any ideas? ... View more