Hello All! I am trying to parse McAfee firewall logs but the props.conf I am using doesn't seem to work. This is my props.conf: [source::<source location>] TIME_PREFIX = Time:\s+ TIME_FORMAT = %m/%d/%Y %H:%M:%S LINE_BREAKER = ([\r\n]+)Time: SHOULD_LINEMERGE = false This is the log that I want to break at each timestamp line: Time: 03/04/2021 17:31:18 Event: Traffic IP Address: 172.16.0.21 Description: Path: Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915) Matched Rule: Block all traffic Time: 03/04/2021 17:31:19 Event: Traffic IP Address: 172.16.0.21 Description: Path: Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915) Matched Rule: Block all traffic Time: 03/04/2021 17:31:20 Event: Traffic IP Address: 172.16.0.21 Description: Path: Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915) Matched Rule: Block all traffic Time: 03/04/2021 17:31:21 Event: Traffic IP Address: 172.16.0.21 Description: Path: Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915) Matched Rule: Block all traffic Time: 03/04/2021 17:31:22 Event: Traffic IP Address: 172.16.0.21 Description: Path: Message: Blocked Incoming UDP - Source 172.16.0.21 : (54915) Destination 172.16.0.255 : (54915) Matched Rule: Block all traffic ...   Thank you so much! ... View more

I run following search to look for orphaned searches/alerts: | rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0 | search orphan=1 disabled=0 is_scheduled=1 | eval status = if(disabled = 0, "enabled", "disabled") | fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions | rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing I found a few which belong to some departed users. However, when I go to Settings>Searches, Reports, and Alerts, they are not listed. I also searched $SPLUNK_HOME/etc/apps to make sure all the departed users' names to be replaced with a current user's name. Yet the same orphaned searches turned up whenever I run the above search. What did I miss? Thanks! ... View more

Hi, I am having problems getting the FIM data from Tripwire Enterprise with the Python script while the SCM pull worked just fine. I have a distributed Splunk deployment so according to the TE app documentation, I put TA_te on the heavy forwarder. The Python scripts are supposed to pull the data and deposit it in /opt/teexports. I can see that /opt/te/exports/SCM is getting updated and the dashboard on the search heads is populated with the SCM data. However, there's no FIM data. Reviewing the splunkd.log I can see some Python errors as below: 10-29-2015 15:20:46.620 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" Exception: <ns0:Fault xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"><faultcode>SOAP-ENV:Client</faultcode><faultstring>Failed to find object in database 10-29-2015 15:20:46.620 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" (CONTENTS), id = -9223372036298495233</faultstring><detail><com.tripwire.space.core.persistence.db.ObjectNotFoundException /></detail></ns0:Fault> 10-29-2015 15:20:46.625 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" Traceback (most recent call last): 10-29-2015 15:20:46.625 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" File "/opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py", line 162, in <module> 10-29-2015 15:20:46.626 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" main() 10-29-2015 15:20:46.626 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" File "/opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py", line 151, in main 10-29-2015 15:20:46.626 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" subprocess.check_call(cmd, shell=True) 10-29-2015 15:20:46.626 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" File "/opt/splunk/lib/python2.7/subprocess.py", line 540, in check_call 10-29-2015 15:20:46.628 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" raise CalledProcessError(retcode, cmd) 10-29-2015 15:20:46.628 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA_te/bin/tripwire_fim.py" subprocess.CalledProcessError: Command '/opt/splunk/bin/splunk cmd python "/opt/splunk/etc/apps/TA_te/bin/tripwire.py" -s "10.20.12.24" -u "yyyyyy" -p "xxxxxxxxxxxx" report -T "DCR" -t detailedchanges_rpt -P BooleanCriterion,currentVersionsOnly,false,displayUsers,true,displayCriteriaAtEnd,true,showContentDiff,true:RelativeTimeRangeCriterion,229,day,"In the last 229 day" -F CSV -o "/opt/teexports/FIM/tmp/DCR-hist.csv"' returned non-zero exit status 1 ... View more

I have a distributed deployment and use a Universal Forwarder on Windows to get the event logs and performance information into indexers. After deploying the Splunk_TA_windows to the Windows client, the event log data comes into the indexers and get indexed to wineventlog just fine. However, I still get errors as below: Search peer idx2 has the following message: received event for unconfigured/disabled/deleted index='sec_events' with source='source::Perfmon:Available Memory' host='host::Prod-TS1' sourcetype='sourcetype::Perfmon:Available Memory' (1 missing total) 8/7/2015, 3:40:29 PM I checked both my indexers and forwarders, but could not find where the index "sec_events" came from. If you have any suggestions please let me know. Thanks! ... View more