I have a message field in an event id that isn't extracting properly. The part I've having an issue with is when there's a special character in the middle (of unknown length string) of the string. For example, I can extract "test\user" with no issues, but when I have something like below: test\user.name test\user-name test\username-was-here test\username-was-not.here$ I'm unable to extract them. I've tried: rex field=Message "(?<SubjectID>[1-9A-Za-z$].+[-$._].+[1-9A-Za-z$] I've tried the $ with the \$ as well, but this doesn't provide any results. I've also tried taking the 'test\user-name' field and plug it in directly to see if it was show me a result, but that failed to work as well. Is there a way to do this where I could take into account all scenarios above? Here's the log entry: Below is a message that doesn't work due to spaces in the name/ID: Thanks! ... View more

Has anyone configured the PP TAP application in a clustered environment? I've been unable to find configurations to reference. We need to change the index the application sends to, add the API key information to the data input, and change the refresh times. We have 3 search heads, and a deployment server. I'm tempted to just configure these manually on the SH themselves, and not worry about shcluster-bundle. I haven't found anything that tells me what files to modify so I can push them to the SH. Thanks! ... View more

I need to find how much volume hosts are sending to my "main" index. The search below queries the internal index, and I'm not seeing the hosts that I need. If I search a specific host under main index, the host is there and actively sending data to the indexer. I've tried modifying the search from index="_internal" to index="main", and it doesn't report anything back From: index="_internal" source="*metrics.log" group="per_host_thruput" | chart sum(kb) by series | sort - sum(kb) To: index="main" source="WMI:WinEventLog:Security" | chart sum(kb) by series | sort - sum(kb) But, with only: index="main" source="WMI:WinEventLog:Security" Brings back 2710 results from today. I have hosts that are sending to this index, and I need to be able to tell how much data they're sending, but the internal index isn't showing them for some reason.... ... View more

What would cause times to be off on received logs? I installed the UF on a server yesterday that had the correct time. If I search for "All Time" for that host, I receive log entries for 8/1/2018, but if I specify ANY time range - last 7 days, last 24 hours, etc., it shows the correct time. Is this a bug in Splunk? ... View more

I wanted to use a file to use for usernames. For example, I want to know when the following people's account information changes: usernames.csv: useraccounts "jim smith" "john temp" "bob lynn" If the user above has their password changed, I want to be notified. I have the csv uploaded into splunk, but I'm not sure how to use it to compare for this reason. The search I've tried, which isn't even close to working, is below: sourcetype=* | lookup vipUserAccounts useraccounts OUTPUT vips | stats count by vips This was just to test if the lookup file was even seeing the three accounts and I get an error. So, what I'm looking for is to be able to alert on password changes when one of the accounts above is changed. The alert will be ran in realtime, and I'm trying to do this so I can just edit the text file to add/remove users. Thanks! ... View more

We have pretty short lease times for dhcp clients. I'm running the getwatchlist addon for Splunk, and what I'm wanting to do is to correlate who had an address during the time of the "bad" query. I have two indexes: dnsserver and dhcp. DNSServer is queried with the lookup table malwaredomains. If it sees a host query for a bad domain that's in the malwaredomains list, it flags it with "isbad=true". This works fine, but what I've noticed is that DNS doesn't log the hostname at the time of the query. In order to get this information, I'm receiving dhcp logs and modified my lookup to do a join operation: index=dnsserver | lookup malwaredomains domain | search isbad=true | rename srcIP as assignedIP | join host,assignedIP [ search index=dhcp status="assign" OR status="renew"] | fields assignedIP,hostname,status,domain | table hostname, assignedIP, status, domain My result for the above query would be something like below: client.domain.name x.x.x.x Renew dl2.v47installer.com The problem that I'm running into is that there could potentially be more than one host that may have been associated to the x.x.x.x address above in one day. I know our lease times are 4 hours. I think I'm looking for a way to make the above query do the following: Find the bad domain queries Associate the IP address that does the query to an IP address in DHCP Report on the hostname and IP that falls within the range of time. Let's say that I have 3 hostnames associated to the IP address for that day. If I do the above query, it can show multiple hostnames or a single hostname. The query simply isn't accurate though. For example, the above shows one host with an IP address. If I break that query up, that single host had 3 different IP addresses: one on wireless, one wired, and one on guest wireless. The time the query was done was at 1:25PM, but the update from the IP address above was at 1:54PM with the prior being around 9:54AM and a different address altogether. In short (I know this wasn't), we'd like to know what hostname could be infected when the query is made for a bad domain. I'm close, but I don't think this is accurate, and I'm not entirely sure I'm going to be able to make it 100% accurate. Thanks! John ... View more