Hi Splunkers, for an addon I'm making, I need to perform a sourcetype override. The general mechanis is clearly explained on this documentation: Override source types on a per-event basis and I used it with different result. If I use, in the props.conf file, a sourcetype like <spec>, it works fine; so, if my data born with sourcetype A, and A is puttend in the props.conf as spec, and I want to override it with B, where B is putted in transforms.conf under the proper regex, nothing goes wring and I achieve the desiderd result. Now, suppose I want switch, in prop.conf file for <spec> parameter, from a sourcetype to a source and that this source is a file under a specific location. Of course, I could put the full path of source; but, for different reasons, this path may change in our production environment, so I need to switch from full path to a partial one; the worst case is whre we must change from:     C:\sub1\sub2\sub3.test_file.txt     to:     ...\test_file.txt     So, my question is: what is the proper wildcard syntax to achieve this purpose? I tried until now:     ...\test_file.txt C:\...\test_file.txt //C:\...\test_file.txt     but they does not work and the sourcetype is not overriden. ... View more

Hi Splunkers, I have an issue with the use of Data Model, eval command and sourcetype as filter. Let me explain better. Customer asked us to modify the field  action on Data Model Email: if the sourcetype is a particular one, let's say xxx, action must be equal to another field called  final_action Otherwise, the normal behaivor is fine. Now, in the Email Data Model the field action is a calculated one with the following eval expression: if(isnull(action) OR action="","unknown",action) So, I thought to simply modify it in a case expression, adding the check on the sourcetype; based on this, I tested the following search: | from datamodel:"Email" | eval action = case(isnull(action) OR action="","unknown", sourcetype="xxx", final_action, 1=1, action) | stats count values(action) as action by sourcetype  But it does not works; I mean, the field action is correctly filled for all other sourcetypes we have, but the action output field, for sourcetype xxx is empty. My first doubt was: does the problem exists because I used different fields in case function, not equal between them? So I used this search: | from datamodel:"Email" | eval action = if(isnull(action) OR action="","unknown", action) | eval action = if(sourcetype="xxx", final_action, action) | stats count values(action) as action by sourcetype But the action output for sourcetype xxx is still empty. I'm sure that the field is correct and populated because if I use a search without datamodel, comparing 2 different sourcetype we have for mails, the search work fine. For example, if I use: index=* sourcetype IN (xxx, yyy) | eval action=if(sourcetype="xxx", final_action, action) | stats count values(action) as action by sourcetype The outoput is the desiderd one: the action field for yyy is the already exiting one, while for xxx is overwritten with final_action values. ... View more

Hi Splunkers, for our environments, I needed a custom parser for some waf logs, so I created an addon to provide this. The addon has been created on a local Splunk istance on my Desktop; once completed and tested, it has been loaded on our Splunk Cloud istance, where it has Global permissions. The point is the following: the addon, once installed on cloud, correctly parse the logs and perform field extraction as desidered, coerently with results got on local istance; also, the events are correctly tagged with "attack" and "ids" as desired, due we want to see those events on Data Model Intrusion Detection. Unfortunately, when I try to perform a search with Intrusion Detection DM, the events are not present; a simple search like   |tstats summariesonly=true fillnull_value="N/D" count from datamodel=Intrusion_Detection by sourcetype   does not show me, in output, the sourcetype created during addon creation. I followed the usual way I use to create addon Data Model matching, which is: 1. create a eventtype in eventtypes.conf with syntax:   [<eventtype name>] search = <sourcetype> <parameters list>   2. use the above eventtype in tags.conf for tagging, with syntax   [eventtype=<eventtype name>] attack=enabled ids=enabled   If permissions are ok, what could be the root cause? ... View more

Hi Splunkers, today I'm facing a problem related to temporal sequence between a multisearch and a search, but let me introduce the context and explain better. In ES, I have to build a correlation search that must verify 2 events in time order: 1. First, check if a trojan, backdoor or exploit is founded on a destination host, from some source. 2. Then, check is from the same source on the same destination a login and/or an account change is performed. Bonds: use datamodels (if possible) and avoid transaction. Now, I know that I can use: 1. Intrusion Detection for point 1. 2. Authentication and Change for point 2 Now, the search for point one is something like that: | tstats summariesonly=true fillnull_value="N/D" count from datamodel=Intrusion_Detection where IDS_Attacks.signature IN ("*trojan*","*backdoor*","*exploit*") by IDS_Attacks.dest, IDS_Attacks.src, IDS_Attacks.signature, index, host | `drop_dm_object_name("IDS_Attacks")` while, for point 2, due I have 2 different datamodels I builded it with a multisearch: | multisearch [| tstats summariesonly=true prestats=true fillnull_value="N/D" count from datamodel=Authentication where nodename="Authentication.Successful_Authentication" by index, host, Authentication.src, Authentication.dest | `drop_dm_object_name("Authentication")`] [| tstats summariesonly=true prestats=true fillnull_value="N/D" count from datamodel=Change where nodename="All_Changes.Account_Management" by index, host, All_Changes.src, All_Changes.dest | `drop_dm_object_name("All_Changes")` ] | stats count by src, dest, index, host | stats count values(host) as host, values(index) as inde by src, dest I tested both search separately and they work well. Now the point is: how to tell to Splunk that search 1 must trigger before search 2 without transaction?  I thougth about funcion  min(_time) max(_time) and the use of  eval to check is first time occurrence of block 2 is greater than last time occurrence of block 1, but I'm struggling about the correct use of this functions, because the field with time occurrence is always empty, so it's clear I'm wrong in my combined code. Consider for example the multisearch of block 2, where I tested the use of min: | multisearch [| tstats prestats=true fillnull_value="N/D" min(_time) as firstSuccess, count from datamodel=Authentication where nodename="Authentication.Successful_Authentication" AND by index, host, Authentication.src, Authentication.dest | `drop_dm_object_name("Authentication")`] [| tstats prestats=true summariesonly=true fillnull_value="N/D" min(_time) as firstSuccess, count from datamodel=Change where nodename="All_Changes.Account_Management" by index, host, All_Changes.src, All_Changes.dest | `drop_dm_object_name("All_Changes")` ] | stats count min(firstSuccess) as firstSuccess by log_region, log_country, src, dest, index, host The idea is to find the first occurrence in both search of multisearch with min(_time) and then, in the following stats, use min(firstSuccess) to find the smaller one between them; the search show me in output the required fields, except fisrtSuccess which is empty. ... View more

Hi Splunkers, in our environment we use Splunk DB connect. When we configure a new connection, on differents DBs we are facing the following error:     The error is self explaining and it will be very clear for us in a normal condition, but what sounds strange is: 1. When we confgure the connection, we do NOT use encryption; we clearely disable encryption and flag the read only parameter 2. The error rise up with many DB of the same network, but not all. 3. It has been ensured by DB team that no encryption has been set on DB servers of that network. So, my wonder is: why we face a TLS error if we are telling to SPlunk to not use it? And how to solve it? ... View more

Hi Splunkers, I'm in trouble with a correlation rule creation. The purposes of the rule is the following one: if a User Group related to a Databases is changed by a remote user, the rule must trigger. Here, some addictional data; For change we mean that a user is added or removed to a group and/or an entire Database user group is deleted. We are not focusing on a specific data base product; the fact that the host involved is a database is get by checking 2 lookup table where the database IP and ports are putted. If possible, we had to use Datamodel instead of sourcetype; for this, I checked both Database and Authentication data model but I see that, in the ready field, we are able to extract only data about users, not groups. Any Idea? ... View more