Hi all I have a tcp stream from logstash to a universal forwarder, the forwarder is already used to forward other inputs (windows log from other servers and some stanzas to monitor local files) and works fine. I've setup a new tcp input on tcp port 9999, this is my inputs.conf [tcp://9999] index = firewalls_index sourcetype = firewalls disabled = false In my Splunk I don't see anything in this index but if use netcat (stopping splunk svc) I can see the stream of kv values, thats certified and has no network issue. Is there is a way to understand/view the raw data routed to Splunk? thanks! ... View more

I've searched everywhere but all solutions seem workaround, can someone can suggest the best way to prevent the indexing of message field in the windows eventlog sourcetype? I want to apply the same method to my firewall syslog messages, in other words, I want to remove the unnecessary field from events before it's indexed. ... View more

Hi guys! i've this scenario: hq-splunk-fwd-01 splunk-fwd-01 splunk01 syslogsrv + universal forwarder => syslogsrv + universal forwarder => indexer hq- forwarder is installed on a centos in a different networkfrom the other parts of installation but it can reach splunk-fd-01 with routing. I've already some UF on other windows VM that communicate with splunk-fwd-01 without problem. i think that isn't a network problem but is a my fault on some configuration ... on hq-splunk-01 i've a syslogngsrv such as on splunk-fwd-01 ... i've set splunk-fwd-01 as forwarder in the outputs.conf of hq-splunk-fwd01 (port 9996) and a monitor stanza for /var/log/syslog/myfolder .... but i can't find anything on my splunk ... i've checked metrics.log with this query: index = _internal | search "x.x.x.x" source="/opt/splunkforwarder/var/log/splunk/metrics.log" where x.x.x.x is the IP of hq-splunk.fwd-01 ... see the attachment for output I can see the connection but don't find the events ... in other word: where is my data! ... View more

Hi all, i'm trying to record all RD session on my server, i've write this query: index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd | eval duration = (duration* 1000) |table "_time" "host" "username" "EventType" duration It works but I need to separate every session by host, in other words transaction must be evaluated only if the host value of the start event is the same of the end event. thanks ... View more

Hi guys I need to extract two different fields from two different events in two different index only if these two events have a common field value and occur in a specific time range. For example: EVENT1: index SRV _time 10:49:01 username bilbo.baggins exchangecookie 123456789 EVENT2: index LB _time 10:49:00 srcip 123.45.67.89 exchangecookie 123456789 EVENT 3 index LB _time 10:49:00 srcip 123.45.67.89 exchangecookie abcdefghi EVENT 4 index LB _time 10:51:00 srcip 123.45.67.89 exchangecookie 123456789 I want to draw a table with this info: username from index SRV, srcip and _time from index LB only if exchangecookie is the same in both events and the time spwn is less than 5 sec. In this case the output wil be: 10.49.00 bilbo.baggins 123.45.67.89 Time and src IP from EVENT 1 and username from EVENT 2. EVENT 3 must be ignored because have a different exchangecookie and EVENT 4 was indexed too late. I've read about join but I don't think it's the solution. ... View more

Hi all, I'm trying to index all events without a specific word from a monitor stanza. This is my input.conf: [default] host = srvname [monitor://C:\inetpub\logs\LogFiles\W3SVC1] source = ExchangeIISLog index=exchange_iis ignoreOlderThan = 1d` i've configured a stanza in props.conf and transform.conf here are the stanzas props.conf [source::ExchangeIISLog] TRANSFORMS-MBdrop = ExchangeIISLogFilter transform.conf [ExchangeIISLogFilter] REGEX = (?m)^(.*HealthMailbox.*)$ DEST_KEY = queue FORMAT = nullQueue i want index only event without the word "healthmailbox" .... below an example of the txt file #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2018-02-07 13:00:04 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2018-02-07 13:00:04 192.168.1.71 GET /Microsoft-Server-ActiveSync/healthcheck.htm - 80 - 192.168.1.111 - - 200 0 0 15 2018-02-07 13:00:04 192.168.1.71 GET /ews/healthcheck.htm - 80 - 192.168.1.111 - - 200 0 0 15 2018-02-07 13:00:04 192.168.1.71 GET /rpc/healthcheck.htm - 80 - 192.168.1.103 - - 200 0 0 15 2018-02-07 13:00:04 192.168.1.71 GET /owa/healthcheck.htm &encoding=; 80 - 192.168.1.103 - - 200 0 0 15 2018-02-07 13:00:05 192.168.1.71 GET /autodiscover/healthcheck.htm - 80 - 192.168.1.111 - - 200 0 0 46 2018-02-07 13:00:14 192.168.1.71 GET /Microsoft-Server-ActiveSync/healthcheck.htm - 80 - 192.168.1.111 - - 200 0 0 15 2018-02-07 13:00:14 192.168.1.71 GET /rpc/healthcheck.htm - 80 - 192.168.1.111 - - 200 0 0 31 2018-02-07 13:00:14 192.168.1.71 GET /owa/healthcheck.htm &encoding=; 80 - 192.168.1.103 - - 200 0 0 31 2018-02-07 13:00:14 192.168.1.71 GET /ews/healthcheck.htm - 80 - 192.168.1.103 - - 200 0 0 31 2018-02-07 13:00:15 192.168.1.71 GET /autodiscover/healthcheck.htm - 80 - 192.168.1.103 - - 200 0 0 15 2018-02-07 13:00:18 ::1 GET /Microsoft-Server-ActiveSync/default.eas &CorrelationID=<empty>;&cafeReqId=be1ce778-6b21-4a8b-a776-045738407c8d; 443 HealthMailbox0d8a2628ac704cf8ae7afa1c86846f0f@gesca.it ::1 AMProbe/Local/ClientAccess - 200 0 0 31 2018-02-07 13:00:18 ::1 GET /ecp/ &CorrelationID=<empty>;&cafeReqId=1631e6ea-8235-42ab-9931-a95d19a0a656;&LogoffReason=NoCookiesGetOrE14AuthPost 443 - ::1 AMProbe/Local/ClientAccess - 302 0 0 31 2018-02-07 13:00:18 127.0.0.1 GET /AutoDiscover/ &CorrelationID=<empty>;&cafeReqId=e7dd627f-62e2-4a17-b7e8-2c1418c7835b; 443 GESCA\HealthMailbox0d8a262 127.0.0.1 AMProbe/Local/ClientAccess - 200 0 0 62 2018-02-07 13:00:23 127.0.0.1 GET /ews/ &CorrelationID=<empty>;&cafeReqId=d583378e-ee9a-496c-b51c-a84508702876; 443 GESCA\HealthMailbox0d8a262 127.0.0.1 AMProbe/Local/ClientAccess - 200 0 0 31 2018-02-07 13:00:23 192.168.1.71 GET /owa/healthcheck.htm &encoding=; 80 - 192.168.1.103 - - 200 0 0 46 2018-02-07 13:00:23 192.168.1.71 GET /rpc/healthcheck.htm - 80 - 192.168.1.111 - - 200 0 0 46 2018-02-07 13:00:23 192.168.1.71 GET /ews/healthcheck.htm - 80 - 192.168.1.111 - - 200 0 0 46 2018-02-07 13:00:23 192.168.1.71 GET /Microsoft-Server-ActiveSync/healthcheck.htm - 80 - 192.168.1.103 - - 200 0 0 46 2018-02-07 13:00:26 192.168.1.71 GET /autodiscover/healthcheck.htm - 80 - 192.168.1.111 - - 200 0 0 0 ... View more