So I'm trying to get a distinct count of source mac addresses by device. The srcmac gives me the mac address The devtype gives me the type of device like Windows, Mac, Android etc. When I run the search below it gives a count of all events, it looks like where there's both a srcmac and a devtype. The problem is I only want to know the count of unique values for srcmac, so only unique mac addresses in this case. How would I go about reformatting the search below to do this? | stats dc(srcmac) by devtype ... View more

Let's say I'm doing a stats count by x,y How would I formulate a WHERE that compares the string value of x and y and only returns the stats count when there's a difference. So like stats count by x,y |where x != y ... View more

My current search looks like this: index=smt_gsuite sourcetype=gapps:report:drive "events{}.name"=change_user_access | stats count by actor.email,events{}.parameters{}.owner,events{}.parameters{}.target_user This query seems to show me the person who initiated the access change, the owner of the file and the user who now has access to the file. What I cant seem to figure out how to do is specifically write a search that shows "ownership changes" to files not just access changes. Has anyone used the gsuite for splunk app and been able to write a search that shows ownership changes? ... View more

Here's my query: index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count by devtype What I want to do is get something like this : devtype iphone 100 windows 105 Android 200 I don't want stats on all of the events. I just want the totals of of all the possibilities for the devtype Field. How would I write this? ... View more

Has anyone used the gsuite app for splunk developed by Kyle Smith to track deleted emails? I'm wondering if someone had a working query they could share? ... View more

I'm hosting my splunk instance in AWS and I'm trying to whitelist the specific IPs that the app will use when its calling api.mimecast.com over https. Unfortionatly AWS doesn't allow you to use hostnames on security groups. Does anyone know the specific IP's that need to be whitelisted in order for this app to work? ... View more

Maybe this is normal behavior but I uploaded the CrowdStrike Falcon Endpoint Add-on and configured my account and input through GUI. I can see a file called crowdstrike_falcon_host_inputs.config in the local folder for the app, which has the info I supplied when creating the input though the gui. But my question is why isn't the input showing up under settings>data inputs? The main reason I ask is because I'm having trouble ingesting data from the TA and am wondering if this is at all related. Thanks! ... View more

I've setup the Splunk Add-on for CrowdStrike using the guide found on splunkbase. 1) On the configuration tab II added my CrowdStrike account with the API UUID and Key that I found in the Crowdstrike GUI under support. 2) On the inputs tab I created an input That's the only things the directions ask you to do but when I test to see if data is being collected I get noting. index="crowdstrikeindex" sourcetype="crowdstrike:falconhost:json" ... View more

I have a denial of service policy setup on one of my FW and it's set to log everything but I'm not sure how to search for DOS logs in Splunk? The Fortigate Documentation says that banned_src=dos should work but I'm not seeing anything like that. Has anyone been able to query DOS using this app? ... View more

Hello, We've had the Mimecast for Splunk v2 running in our environment for almost a year now and most of the data has been flowing in. We've never seen any Data under the Target Threat Protection drop down and I always thought this was just because we don't have those features enabled in Mimecast. We enabled those features about 15hrs ago and we're still not seeing any data. The mimecast user has "basic Admin " privileges and we've enabled "Advanced Logging" all setup by the following guide: https://community.mimecast.com/docs/DOC-2142#jive_content_id_Mimecast_Permissions Is there anything that I can check to see why this might be happening? ... View more