How do you determine what goes down the 9997 pipe verses the encrypted 9998 pipe on your forwarders? ... View more

I know this is an old thread but thought I would post an answer for future reference. I was getting https:///en-US/app/splunk_app_db_connect/ftr# with a blank screen. I am using Chrome. After upgrading from 3.11.1 to 3.12.1, I was still only getting a blank screen so I removed DB connect and installed 3.11.1. No luck - still a blank screen. Finally, I cleared the browser cache and was able to access DB Connect without any issues. ... View more

Thanks Rich, I saw that too hence the reason for the question and since MLTK is Splunk Cloud supported and MLTK is a prerequisite for the "DGA App", I was just curious if any one knew. I have opened a ticket with support. ... View more

Thanks Rich,  I have opened a ticket with Splunk Support. ... View more

If I am following you right, my search without any exclusions will return  the fields A1Sender,  A2Sender, Recipients{} plus some other fields not related to the lookup csv such as user, _time, src_ip ... The csv contains A1Sender, A1Sender_domain, A2Sender, A2Sender_domain, Recipient{}. The data for each roll is manually added into the csv as they are discovered.  Not every field is filled as in the example below. A1Sender                        A1Sender_domain       A2Sender                      A2Sender_domain     Recipient{} fred@flintstone.com                                                 tinker@sbuggy.com                                                                                     *@bbunny.com,                mmouse@wd.com                                                                                 *@wd.com,                                                                   *@bbunny.com,                                                                                                                                                                                    myemail@me.com ... View more

A1Sender,  A2Sender and Recipients{} are fields within the events. I am looking to exclude anything in the lookup table from the results found in {mysearch} If fields A1Sender, A2Sender contain values then omit them from the results.  This works in the first example but getting the rest to work have been difficult. If field Recipient{}] contain values then omit them from the results.  If field A1Sender_domain, A2Sender  convert A1Sender_domain into A1Sender and use A2Sender to omit from results If field A1Sender_domain, A2Sender_domain same as above by A2Sender_domain will be A2Sender. Did that answer your question? ... View more

Did you find a resolution to this issue? I am having the same issue after upgrading from 3.2.0 to 3.3.2. Thanks ... View more

Question #2 This won't tell you the version but will indicate whether the new package is up to date. The fwd_config field will tell you either it is the "legacy" or "new" package. index=_internal source=*metrics.log group=tcpout_connections name=splunkcloud* | stats latest(_time) AS _time latest(name) AS name by host | rex field=name "(?<output_group>.+?)\:" | eval fwd_config=if(output_group="splunkcloud","legacy","new") | stats count by _time host output_group fwd_config | reltime | fields _time reltime host output_group fwd_config | sort 0 fwd_config ... View more

If you are only getting header information, check your query in Log Analytics first. If it works correctly there then it should work in KQL. We haven't had one not work yet. Also, Some logs in Azure only have header info and no data.  Not sure why that is. ... View more

I couldn't find any thing published for this so I had to create a field extraction for each individual query that we implemented. It took a few tries on each one. Just when I thought I had it, MS would through a new format in the query but they have been pretty stable lately. They are not the prettiest regexes but they are working for us. ... View more

Thanks! Using your btool command located the missing server classes.  Everything is working as expected. ... View more

Did you ever make any head way with this? I am having the same issue with pulling in log analytics events from Azure using the Grabber. ... View more

Thanks Jeremy for your suggestion. I switched over to seckit_idm_windows_identities_accounts and it worked with my *.ninja accounts. I did find that adding would work in seckit_idm_windows_identities_nha ... View more

Since the UFs don't parse data, I moved my P&T back to my HFs handling this chore. I also changed the P&T by merging it with my current TA_stream P&T. Now that I have all the my DNS Streams coming to my HFs, I have to be able to let the DNS servers send everything through but limit my DNS forwarders to only allow the single Domain queries/responses through so this is what I came up with which still doesn't work. I get everything from both the DNS servers and the DNS forwarders. props.conf [stream:dns] TRANSFORMS-null=setnull_stream_dns, setparsing, setnull_fwd transforms.conf [setnull_fwd] SOURCE_KEY = MetaData:Host REGEX = ^DNS_FWD* DEST_KEY = queue FORMAT = nullQueue # Stream config - Remove all DNZ DNS Forwarders [setparsing] REGEX=^.?(?:query|response)\":[\"(?i)(?:dns.name.here).$ DEST_KEY=queue FORMAT=indexQueue Stream config - only collect data for listed url [setnull_stream_dns] REGEX=^.?(?:query|response)\":[\"(?i)(?:^empty|.?live.com|.?microsoft.com|.?office365.com).*$ DEST_KEY=queue FORMAT=nullQueue Stream config ... View more

I am using rsyslog to read in my netscaler events. I have inputs.conf set up to read in all of my rsyslog events and set the sourcetype for each. This is my Netscaler code in my local/inputs.conf Netscaler [monitor:///opt/syslog/netscaler//.log] sourcetype=citrix:netscaler:syslog index=network host_segment=4 disabled=false Then I use a local/props.conf to establish the time and the local/transfroms to extract the netscaler hostname. From there the rest of the fields are extracted by the netscaler add-on. If you want to try this route, I can work you up a time and hostname extract based on your log example. ... View more