Hi friends!   How to discard Windows events of type EventCode = 4663 from Splunk executables? Dismiss only Splunk-related events: SplunkUniversalForwarder \ bin \ splunk-powershell.exe splunk-regmon.exe splunk-admon.exe To reduce the consumption of the Splunk license. Example log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{}'/><EventID>4663</EventID><Version>1</Version><Level>0</Level><Task>12802</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2021-02-23T14:56:54.615235600Z'/><EventRecordID>835675728</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='10472'/><Channel>Security</Channel><Computer>DC01.net</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>DC01$</Data><Data Name='SubjectDomainName'>DC01</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>Security</Data><Data Name='ObjectType'>SymbolicLink</Data><Data Name='ObjectName'>\SHARE??\E:</Data><Data Name='HandleId'>0x94</Data><Data Name='AccessList'>%%4544</Data><Data Name='AccessMask'>0x1</Data><Data Name='ProcessId'>0x1fa8</Data><Data Name='ProcessName'>E:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe</Data><Data Name='ResourceAttributes'>-</Data></EventData></Event>   Thanks in advancend!   James \o/ ... View more

Hi All. How to break this log block so that it reads each row as an event, and this log is not in timestamp format? The date would be the start and end of the user session on the system. The following is an example of the log: cod|user |system |day|month|year|hour|minute|day|month|year|hour|minute 001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cis2200000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cis2121000 |01|03|18|10|46|01|03|18|10|46 001|00129810|cisli2100m000 |01|03|18|10|46|01|03|18|10|46 001|00821888|cis0121000 |01|03|18|10|46|01|03|18|10|46 001|user001 |cis2200000 |01|03|18|10|46|01|03|18|10|46 Do I have to configure in props.conf and transform.conf by sourcetype? REGEX = = (.{3}).(.{8}).(.{16}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}).(.{2}) FORMAT = emp::$1 user::$2 session_id::$3 datei_mday::$4 datei_month::$5 datei_year::$6 datei_hour::$7 datei_minute::$8 datef_mday::$9 datef_month::$10 datef_year::$11 datef_hour::$12 datef_minute::$13 I tried to create this REGEX, but it did not work. Can you help me please? Best Regards. ... View more

Hi guys! How to setting splunk an architecture of 01 heavy forwarder, 01 search head and 01 indexer? I need to collect Windows events, firewalls and Cisco routers in an environment with heavy forwarder 01, 01 and 01 head search indexer. How would the configuration of each? Please help. ... View more

Hello guys! I need help to create "filter out" in Palo Alto firewall events. I want to discard the DNS condulta events, whose field is dest = 8.8.8.8. I created entries in props.conf and transform.conf props.conf #### ########## FILTER OUT [source :: udp: 5514] TRANSFORMS-null = setnull4 transform.conf FILTER OUT FIREWALL [setnull4] REGEX = ^ (?: [^ \ N] *) {8} (P [^,] +?) DEST_KEY = queue FORMAT = nullQueue I also tried REGEX = (. *) 8.8.8.8, but it did not work. Can anyone help me how to create a "filter out" to discard these events? Thank you. ... View more

I am attempting to identify users who are sharing access to systems from 2 or more IPs within a given amount of time of 3s. How could I search for this? Thank you very much in advance. ... View more

I need to create alerts to logon failure of various types of logs that are coming to the indexer, for example: windows (4625), Linux, Aix, z / OS mainframe (SMF-80), AS / 400. It can create login failure alert in a single search covering all index and sources? Tks ... View more