Hi, I'm trying to view event related to a specific country or city based on the source ip,so i ran the following query. index=firewalls | iplocation allfields=true src_ip | stats count by Country City which works fine by giving me a table like: Country | City | count Albania | Durres | 5 Argentina | Abel | 7 . . . when i click any of the city or country to view the events related to that specific region, the search extends like index=firewalls Country=Albania | iplocation allfields=true src_ip | which return zero results because the filed Country comes before iplocation command. i know i can search it manually by entering it at the end of the search query like. index=firewalls | iplocation allfields=true src_ip |search Country=Albania but im running the query on a dsashboard which returns the count for each country ,city and i want to view the event directly by clicking the respective country from the dashboard. How can i do that ? Pls advice ... View more

Hi, I have installed application correctly. but i still don't get the threatscore displayed. I have added the key to file scorelookup.py at /ipreputation/bin/scorelookup.py and restarted splunk. still not working. sample query tried: index="test" dest_port=80 | stats count by src_ip dst_ip | lookup threatscore clientip AS dst_ip | sort -threatscore i have even tried with the sample IPs given in scorelookup.py (14.139.155.194) for which i should be getting a score of 35. but its displayed as 0. Pls advice ... View more

I have installed universal forwarder on TMG server to monitor tmg specific log files. Added the following to inputs.conf under /etc/system/local [monitor://C:\ISALOG*] disabled = false sourcetype = microsoft:forefront:tmg:proxy index = tmg I have installed the TMG add on for splunk and have the sourcetypes to parse the data. The forwarded data from universal forwarder are parsed based on default sourcetype. most of the fields are not parsed. i understand universal forwarder are capable of only forwarding the data. In splunk server, how do i set the receiving log files to be parsed based on a specific source-type.? i have many other logs coming in through the same port from different universal forwarders. ... View more