I installed the Splunk Forwarder x64 Windows version 7.0.0 today on a server. The behavior appears to have changed. In version 6.x.x the windows event logs would go to index wineventlog. In the new version of the forwarder, it went directly to the main index. I have two questions regarding this: Is there a way to change the index that is selected before the Splunk forwarder is installed so I don't have to move them from one index to another? Second question, why was there a change in behavior? Thank you in advance for any support you can provide. ... View more

I have imported two Cisco firewall configurations and I am trying to extract IP addresses for our local machines. Therefore I only want to match on subnets that are within our control. I have put together the following command to match on one of our private ip ranges but it appears to always be defaulting to other: index=fw | rex max_match=5 "(?P<IP_add>\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval network=if(cidrmatch("10.0.0.0/8", IP_add), "Network", "other") | stats count by IP_add,network I have also tried to use the | where NOT cidrmatch("10.0.0.0/8",IP_add) notation but that does not seem to select the proper subnets either. Can someone help me understand why the cidrmatch function does not appear to be working for my searches. Do I have to set up the transforms file to use the cidrmatch function and if so can someone help me with the proper code to get this done based on the above? ... View more

I would like to be able to create/run a report that would show me the hosts, sourcetypes for each host, and the sources for each sourcetype. For the sourcetypes and sources, I would like to have beginning date, and end date for each along with a count. Similar to what I find on the data summary page on the main search page but in a more hierarchical structure. It would look something like this: Host(s)->Sourcetypes->Sources with Begin Date, End Date and Count for Sourcetypes and Sources Does a report like this exist in any of the splunk apps or is there a way to create this easily? As we expanded to have multiple indexers, this would be very valuable in documenting what is on each of the indexers for the team and key employees through the institution. It would also be helpful for identifying information that does not need to be indexed or is missing on each of the servers. Thank you for any help you can provide ... View more