Hi there,   So we have one of our event logs set to archive.  But there were some files that are already there before we started ingesting this log.   So if I want to bring these logs in to splunk how do you do it?  I understand in this case UF and WI are only options.   So I did deploy the below with deployment server and restarted deploy-server.  But this log did not make it to splunk.  Any ideas what could be the problem?  or any other way I can bring in exported/archived event logs in to splunk?   [monitor://C:\windows\system32\winent\logs\Archive_log.evtx] disabled = 0 index=idx ... View more

Hi Guys, So if I have two fields with really random set of text, no similarities except the red text.  Does have the 'red' fonts in similarity as below. In this case, is there a way to search to say when first four letters in FieldA exists in FieldB, exclude? This would be very easy in powershell or python.  I am medium splunk user as well, but not sure how I'd do this in splunk. This would be very helpful..  Your help is appreciated in advance.     FieldA FieldB Complete Exch.Complete NotComplete apps.NotC@ Satisftesting Satiapps ... View more

Hi All, I already have a search that gives me a result.  But what I desire to have is we want the results only if another event is NOT true for the user. So for example below gives me result: EventID=4625 earliest=-4h@h latest=-3h@h | table User IPAddress EventID Message Desire is to only show results if there was no 4724 for a specific period.  Would I do it something like this? EventID=4625 earliest=-4h@h latest=-3h@h | table User IPAddress EventID Message earliest=-4h@h latest=-3h@h | append [search NOT EventID=4724 earliest=-7d@d latest=now ]     ... View more

Hi guys, I know this has been asked many times before but it just wont work for me hence the question. I have one index with two sourcetypes.  Both sourcetypes have a field called host.  All I want to do is find hosts that exist in sourcetype 1 but not in sourcetype 2. So index=eventlog.  sourcetype=security and sourcetype=application.  Both have fields called host.  I want to know host that exist in security souretype but not in application. I have tried: Index=eventlog sourcetype=serucurity | search NOT [ sourcetype=application | stats count by host] Index=eventlog sourcetype=security NOT [search sourcetype=applcation | status count by host  ] I was also looking in to the append method but haven't found luck there either. So, how do I find hosts that are in sourceytpe=security but missing in sourcetype=application? Any help is greatly appreciated in advance. ... View more

Hello,   I need help with extracting specific data from logs.  I know this has been discussed few times before but if anyone has worked on powershell logs, you will see that it comes with lot of data.  Even doing simple get process at shell gives you information like below(example1)and scripts and other more complicated commands give lot more data(example2).   What I want to do it only display the commands that were run.  Meaning, extract just the commands in below text and disaplay as table or list in splunk.  How do I do this?  I already have regex that will catch powershell's verb-noun combo like this - [a-zA-Z]{3,}-[a-zA-Z]{3,} - this will match any powershell command.  But how do I extract just the command from lot of junk and display only PS commands and its switches and values?    Example 1)  Creating Scriptblock text (1 of 1):  get-process -Name explorer.exe ID: abc1234-8539-44xy-a16d-0492bfbd0d61 Path:   Exmaple2) Creating Scriptblock text (1 of 1):   For ($x in $y) { get-process -Name Explorer.exe write-host $x  } ID: abc1234-8539-44xy-a16nn-0492mnod0d61 Path: ... View more