How to detect APT (Advanced persistent threat) attack ? ... View more

Hi all, I have some dashboard requirements to be created in "search & reporting app": failed logons by IPAddress failed logons by Username Users Failing to Logon from Multiple IPs I tried this search, but it is not working: index=_audit action=failure | stats count by _time,user,action Can you please help me in finding out the solution? Thanks in Advance, Regards, Mahesh P. ... View more

Hi All, I need to know the features that are not available in the Splunk App for Enterprise Security that are available in Cisco Security Suite, McAfee Web Gateway, Splunk for Bluecoat, Splunk for F5 networks. Can anyone help me in finding this? Thanks in advance, Thanks & Regards, Mahesh P. ... View more

Hi All, We dont have splunk enterprise installed on windows 2008 R2 server. We have installed the Splunk Universal forwarder(6.2.3 version) on windows 2008 R2 server(64-bit). After installing, we configured input.config file and output.config file as, input.config: [default] host = WIN-NR8HN3JRK2V [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] [splunktcp://8000] disabled = 0 output.config file: [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = 192.168.0.175:8000 [tcpout-server://192.168.0.175:8000] Now, how can I get the log data from windows 2008 R2 server to my splunk server(192.168.0.175:8000) ? where it will be stored in my server? Can anyone help me to get out of this? Thanks in advance, Mahesh P. ... View more

Hi ALL, In the "custom visualizations" app, I need to plot custom Tag cloud chart. But when I have changed the query in the XML, the chart is showing different chart(other than Tag cloud chart as expected). Can any one please help me to get out of this? Thanks for the solution in advance, Regards, Mahesh. ... View more

Hi All, I have 2 searches of a log file to be merged as one. When I execute them separately, it is working. Please find below: For File_Transfer: source="F:\\Splunk_Log Files\\*" status="Allow" | eval bytes=round(((recv_bytes)/1024),2) | stats sum(bytes) as File_Transfer by src_ip | eval File_Transfer=File_Transfer." MB" For Infrastructure: source="F:\\Splunk_Log Files\\*" status="Allow" | eval bytes=round(((recv_bytes)/1024),2) | eval Start=substr(dst_ip, 1, 3)| eval End=substr(dst_ip, 1, 3 )|where Start>=1 and End<=85| stats sum(bytes) as Infrastructure by src_ip| eval Infrastructure =Infrastructure ." MB" Can you please suggest a solution for this. Thanks in Advance. Regards, Mahesh. ... View more