This is what I have so far: | eval output = if (Object = "false", [rex field=_raw"(?s)(?.*)(?), "Empty" What I am trying to do is to perform a regex on a line if the value of the object is false. The reason I'm doing this is because I have an xml file that, when generated, the output can be 1 of 2 things. depending the Object value is the rex that needs to be used (I will be changing the "Empty" tag for another rex if this is possible). ... View more

I need to get the today's date, av def date, and version from clamav (Linux antivirus). If you run the ./clamav.sh -V you get this info. However, I want to be able to get that into Splunk. What I've been trying to do is to capture this info through a script (inside a cron job) and output that data into a txt file. So far I have been successful. Here's were I am failing: The only common directory that I can use is the "/home/security" directory. However, when I put the file in that directory, I can't read it. I checked permissions and everything is as it should. I believe I have to do something with the source or sourcetype but I don't really understand that. Some help will be greatly appreciated. ... View more

The following code is intended to do several things. First, I am looking for all the hosts that are producing winevents and counting them. index=winevents | dedup host| stats count as Total Next, I do an ldapsearch for all computers in AD that have a Windows OS. | append [ldapsearch search="(objectClass=computer)" attrs="cn,operatingSystem,operatingSystemVersion" | lookup dnslookup clienthost AS cn | search (opeartingSystem="Win*")] Finally, I count those Windows computers and calculate a percentage between the Total computers and the Windows Computers | stats count as WindowsComputers | append [makeresults [eval var = Total/WindowsComputers)]] | table var The variable var is not displaying the percentage or anything whatsoever. Any ideas? this is the full code: index=winevents | dedup host | stats count as Total | append [ldapsearch search="(objectClass=computer)" attrs="cn,operatingSystem,operatingSystemVersion" | lookup dnslookup clienthost AS cn | search (opeartingSystem="Win*")] | stats count as WindowsComputers | append [makeresults [eval var = Total/WindowsComputers)]] | table var Thanks in advance! ... View more