My search is index="xxx" sourcetype="yyy" topic=IN* | stats list(message_count) as message_count by _time topic | xyseries _time topic message_count **RESULTS** IN-D IN-E IN-F IN-G 920699302 5140913432 7287016676 533221175 944835796 5149696236 7374961617 543221084 971821781 5157796684 7469880690 554235434 996644156 5166493227 7566048933 566376030 1021919011 5175093160 7660955334 577854421 1034750619 5183653994 7756249835 585835689 1043620281 5191941703 7840431124 593107481 Once I add delta command to get results I get accurate data for all topics except IN-F, but when I only run delta for topic IN-F Splunk returns accurate results index="historic_forensics" sourcetype="kafka_event_count" topic=IN* | stats list(message_count) as message_count by _time topic | xyseries _time topic message_count | delta IN-DT as IN-D | delta IN-E as IN-E | delta IN-F as IN-F | delta IN-G as IN-G | eval date=relative_time(_time,"-1d") | eval _time=strftime(date, "%F") | table _time IN* Is there something I'm doing wrong? ... View more

The whole event is coming in as below. Need eventtype to extract "event_type={type}" and size to extract all the values in size {"event_type":"event_type=adsad","size":"128844"} {"event_type":"event_type=dsadsa","size":"388719"} {"event_type":"event_type=blue","size":"1841504"} {"event_type":"event_type=bluecoat","size":"221712725587"} {"event_type":"event_type=casmdsad","size":"12356947232"} {"event_type":"event_type=cisco-ddddd","size":"1553892585172"} {"event_type":"event_type=cisco-edsd","size":"42949321020"} {"event_type":"event_type=cyberark-dsds","size":"77274472"} {"event_type":"TOTAL","size":"4314601844158"} ... View more

Having issues using SEDCMD on Heavy forwarder layer. I have a complex REGEX with multiple pipes |||| But it is not working. I even tried without pipes (||) and one pattern but it still the same issue SEDCMD-mask = s/\,{3}(\"[^\"]+\"|\w+\S[^,]|\"\W.+\"|\S[^,])\,/\,{3}(###)\,/g Trying to mask "Accepted: FW: Global Fun Time (Feb. 11, 2011)" 2018-02-01T21:09:51.445Z,,ABC001.abc.abc.com,,ABC001,14321413285;2018-02-20T21:11:49.539Z;ClientSubmitTime:2019-02-20T21:03:46.000Z,,STOREDRIVER,DELIVER,22037477195836,<2dsadsa213421432141324dewdqe@SN6PR08MB5472.abc.prod.outlook.com>,b3213213c-ef2c-4096-ad06-08d69776e8c9,abc@abc.com,,32956,1,,,"Accepted: FW: Global Fun Time (Feb. 11, 2011)",s.s@abc.com,aa.aa@abc.com,2019-02-20T21:03:47.931Z;SRV=abc.com:TOTAL-FE=0.000|SMR=0.004;SRV=ABC001.com.com:TOTAL-HUB=0.383|SMR=0.157(SMRDE=0.005|SMRC=0.151(SMRCL=0.111|X-SMRCR=0.156))|CAT=0.205(CATOS=0.034 (CATSM=0.033(CATSM-Unified Group Post Sent Item Routing Agent=0.004|CATSM-Malware Agent=0.027 ))|CATRESL=0.005|CATORES=0.163(CATRS=0.163(CATRS-ScanMail Routing Agent=0.148|CATRS-Index Routing Agent=0.013 )))|QDI=0.024;SRV=ABC001.COM.COM:TOTAL-HUB=0.441|SMR=0.165(SMRDI=0.012|SMRC=0.153(SMRCL=0.099|X-SMRCR=0.156))|CAT=0.126(CATOS=0.001 (CATSM=0.001)|CATRESL=0.001|CATORES=0.121(CATRS=0.121(CATRS-ScanMail Routing Agent=0.120 Any help would be helpful ... View more

We are forwarding data coming from our universal forwarders to an external Syslog server. Our current Dataflow Architecture Universal Forwarder -> Regional Heavy Forwarder -> Final Heavy forwarder -> Indexer the data is received from the universal forwarder and an output sends the data to Regional Heavy Forwarder. There is another output that sends the data to the final Heavy forwarder. Once the data gets to the final heavy forwarder we have outputs that output data to indexer and duplicate stream to external Syslog. ISSUE The event count in the external Syslog server from the duplicate stream is almost half than the data that was indexed by Splunk. So from Splunk to our external Syslog server, we are dropping events. ASK I would like to know if there is a tstat command or something is Splunk that would give some metrics of how much data is being sent to the external source from a particular outputs.conf. To send data to external syslog we are using the below solution props.conf [sourcetype] TRANSFORMS-sample = sample_syslog_trend transforms.conf [sample_syslog_trend] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = sample_syslog outputs.conf [syslog:sample_syslog] server = hostname/ipaddress:514 sendCookedData = false ... View more

A requirement is to get a list of domains (src_host) with the count of their actions (blocked, delivered) associated with them. The action field is calculated by the event below 2018-09-26T16:00:09+00:00 x.x.com mail_logs_mail*_push: Info: MID 1966 ICID 2657 To: Rejected by Receiving Control But the src_host is in the field is in the event 2018-09-26T16:00:08+00:00 x.x.com mail_logs_mail*_push: Info: Info: New SMTP ICID 2657 interface Data_1 (1.1.1.1) address 1.1.1.151 reverse dns host abc.net verified yes I would like to know how I can correlate the 2 fields without the 'transaction' command and get the results. ... View more

I would like to convert an event similar to the one below to be a single event when sending it out to an external Syslog server time: 20180717112345 dn: uid=123,ou=employees,ou=ddd,ou=ddd,o=ddd,dc=ddd,dc=ddd changetype: modify replace: userPassword userPassword: ##### replace: modifiersName modifiersName: uid=ddd,ou=ddd,ou=ddd,ou=ddd,o=ddd,dc=ddd, dc=ddd replace: modifyTimestamp modifyTimestamp: 20180717112345Z replace: accountUnlockTime replace: passwordRetryCount passwordRetryCount: 0 replace: retryCountResetTime replace: pwdFailureTime replace: pwdAccountLockedTime ... View more

time: 20180227120538 ... 1 line omitted ... changetype: modify replace: userPassword userPassword: {1234} Currently, I am trying under props.conf but it doesn't seem to work. SEDCMD-masking = s/\suserPassword:\s\S+/\suserPassword:\s/################################################/ ... View more

Base users are unable to get results of the search. As an Admin, I am able to view the data. Search is below. I can query inputlookup by itself without adding the first line and get results back. (index=a) OR (index=b sourcetype=e rec_type=502) [| inputlookup indicator where (TYPE=sha256 OR TYPE=md5) and Status=Active | eval Caller_MD5=if(TYPE == "MD5", INDICATOR_VALUE, null) | eval sha256=if(TYPE == "SHA256", INDICATOR_VALUE, null) | eval file_hash=sha256 | fields Caller_MD5, sha256, file_hash | fields - _raw | format mvsep="OR" "(" "" "OR" "" "OR" ")"] | eval INDICATOR_VALUE=mvappend(Caller_MD5, sha256, file_hash) | eval dst=mvzip(dest_ip, dest_port, ":") | lookup indicator INDICATOR_VALUE OUTPUTNEW COMMENT, SOURCE | where match(COMMENT, ".") | stats earliest(_time) as earliest, latest(_time) as latest, count, values(index) as index, values(src_ip) as src_ip, values(dst) as dst, values(dest_port) as dest_port, values(INDICATOR_VALUE) as INDICATOR_VALUE values(sourcetype) as sourcetype by COMMENT | convert ctime(latest) ctime(earliest) | table COMMENT earliest latest count index sourcetype src_ip dst INDICATOR_VALUE SOURCE ... View more