I've had to write a couple SH regex extractions to get the fields I wanted out. Nothing pretty, nothing that good. I still have to discuss with the team making the request to see if the data is valid or just noise, we haven't gotten that far ourselves. ... View more

Hi @sheamus69 I just started going down this path myself. I've configured the UAG to output syslog to one of my Heavy Forwarders and have started ingesting those logs (no help with sourcetyping from the vmware apps). I am still going to have to build the sourcetype and field extractions so if you already have a working prototype i can start with that would help. Otherwise, i can work on getting some regex for the field extractions and share it once i've completed that. ... View more

I dont believe so. You should be able to install it on your search head and configure the add-on/data inputs there (as long as you're not in a clustered search head env) ... View more

The app should be configured on the Search head and the add-on, which will do your API calls for data inputs, could be on the search head as well unless you are using Splunk Cloud. Then you should have a separate box for the add-on, ideally a HF. ... View more

Your best course of action here would be to leverage an on-prem box as the input box, I currently have it working on our syslog collector which is a Heavy Forwarder on-prem. We had to update the firewall rules to allow the traffic out. Or you can spin up a VM in AWS, install splunk on that and configure the inputs from there. We find the first method useful for other inputs that are not supported on our Splunk Cloud search head ... View more

Has there been any word from Splunk as to what the optimal settings should be? It's strange that the default numbers for the configs throw errors and doesn't return actual results. ... View more

Not yet, our team updated from exchange 2010 to o365 so now I have a whole new bag of issues. ... View more

The above is in regard to the datamodel that is pulled in the Threat Dashboard panel which is stated in the "job inspect" page. None | tstats summariesonly=t count FROM datamodel="pan_firewall" WHERE nodename="log.traffic.end" groupby _time log.protocol span=5m | timechart span=5m values(count) by log.protocol ... View more

Everyone has Read permissions and Sec_User specifically (along with admin and power) have write permissions. I might have to open a support ticket. I figured I would come her first ... View more

I added pan_logs to the default searchable indexes (even though "all non-internal indexes" was already selected). Same thing no results on the Traffic Dashboard ... View more

Sec_User has access to all non-internal by default ... View more

unpacking the .tar file to the deployment-apps/ directory overwrote the the old files with new while leaving the local directory alone. Thank you for the help! ... View more

@gustavomichels Just a little heads up regarding your initial question. I just found this out myself, but if you turn on XML logging for wineventlog all of the values that come in the "message" field gets extracted. You can check it out here: http://blogs.splunk.com/2014/11/04/splunk-6-2-feature-overview-xml-event-logs/ ... View more

So from my understanding of the per-event sourcetype this is my new props and transforms. I am still confused where i would set the field names for the events: transforms.conf [schema_7] REGEX = ^(7)([^,]*) FORMAT = sourcetype::command_log DEST_KEY = MetaData:Sourcetype props.conf [source::/p4rotatedlogs/structuredlogs/track.csv] TRANSFORMS-fields = schema_7 ... View more

Yes i guess a per-event sourcetype is the direction i would need to go. I will read into that. The road i have gone down is based off the answer/comments here: https://answers.splunk.com/answers/316273/field-extracting-lines-from-a-single-file-based-on.html and this helped me get to these props and transforms. Clearly this isn't working though Transforms.conf [schema_7] REGEX = ^(7)([^,]*) FORMAT = Eventtype::$1 timestamp::$2 timestamp2::$3 date::$4 pid::$5 cmdno::$6 user::$7 client::$8 func::$9 host::$10 prog::$11 version::$12 args::$13 tracktype::$14 timer::$15 utime::$16 stime::$17 io_in::$18 io_out::$19 net_in::$20 net_out::$21 maxrss::$22 page_faults::$23 [schema_8] REGEX = ^(8)([^,]*) FORMAT = Eventtype::$1 timestamp::$2 timestamp2::$3 date::$4 pid::$5 cmdno::$6 user::$7 client::$8 func::$9 host::$10 prog::$11 version::$12 args::$13 tracktype::$14 recvCount::$15 SendCount::$16 recvBytes::$17 sendBytes::$18 rpc_hi_mark_fwd::$19 rpc_hi_mark_rev::$20 recvTime::$21 sendTime::$22 [schema_9] REGEX = ^(9)([^,]*) FORMAT = Eventtype::$1 timestamp::$2 timestamp2::$3 date::$4 pid::$5 cmdno::$6 user::$7 client::$8 func::$9 host::$10 prog::$11 version::$12 args::$13 tracktype::$14 dbName::$15 pagesIn::$16 pagesOut::$17 pagesCached::$18 reorderIntl::$19 reorderLeaf::$20 readLocks::$21 writeLocks::$22 f_gets::$23 f_positions::$24 f_scans::$25 f_puts::$26 f_deletes::$27 [schema_14] REGEX = ^(14)([^,]*) FORMAT = Eventtype::$1 timestamp::$2 timestamp2::$3 date::$4 pid::$5 cmdno::$6 user::$7 client::$8 func::$9 host::$10 prog::$11 version::$12 args::$13 filesAdded::$14 fileUpdated::$15 filesDeleted::$16 bytesAdded::$17 bytesUpdated::$18 bytesDeleted::$19 Props.conf [track_log] SHOULD_LINEMERGE=false KV_MODE = none TIME_FORMAT = %Y/%m/%d %H:%M:%S TZ = +1:00 REPORT-fields = schema_7, schema_8, schema_9, schema_14 ... View more

Will this have any impact on Splunk Cloud customers? ... View more