Hello, I need to make a report with 2 different sourcetypes. For the first sourcetype, lets call it st1, I have the list of people removing certain tags from hostnames in McAfee. For the second sourcetype, st2, I have the latest tags state for each hostname, and here I've got more hostnames than in the first sourcetype. What I need to achieve is to make a table with this information together, joined by the hostname field: The time a tag was removed (st1), who removed it (st1), the host with the removed tag (st1), and remaining tags (st2). I have made this search but after the join returns the values of remaining tags for the same host in every row it's not joining, and if it's joining it's joining all the hostnames from st1 with only 1 hostname from st2. Here is my search:   index=epo sourcetype="mcafee:audit" ("Clear Tag" CmdName="Clear Tag") ("tag1" OR "tag2" OR "tag3" OR "tag4") | search NOT [| inputlookup mcafee_epo_allowed_users.csv | fields UserName] | rex field=Message "Cleared\stag\s\'(?<Tag>.+)\'\sfrom\s(?<hosts>.+)\.$" | eval hosts2 = split(hosts,",") | mvexpand hosts2 | rename hosts2 as "Destination host/s" CmdName as "Action" UserName as "Source User" Tag as "Cleared tag" | fields "Action" "Source User" "Cleared tag" "Destination host/s" | join "Destination host/s" [| search index=epo sourcetype="mcafee:inventory" | dedup NodeName | table NodeName Tags | rename NodeName as "Destination host/s", Tags as "Remaining tags" ] | table _time "Action" "Source User" "Cleared tag" "Destination host/s" "Remaining tags"   It returns this: Field hostname in sourcetype 1 is called hosts2, in sourcetype 2 is called NodeName If I can avoid using join its gonna be better. Thanks. ... View more

Hello, im doing a table with data from a sumarized index by month and I need help with the values of the month field I have this: The months are misplaced. my query is: index=mysumarizedindex source=mysumarizedreport  | bin _time span=1mon |rename _time as fecha attack as "Tipo de ataque" | eval fecha=strftime(fecha, "%B-%Y") | chart count by "Tipo de ataque" fecha thanks   ... View more

Hello, I'm working with some ldapsearch queries in my environment, but I have the following problem. Even if I execute the command from an admin account it says this: External search command 'ldaptestconnection' returned error code 1. Script output = "error_message= # host: xxx.xx.xx.1: Could not access the directory service at ldaps://xxx.xx.xx.x:636: password is mandatory in simple bind " Then I tried installing the ldapsearch add-on in my QA environment, and the connection test passed the first time, but the second one didn't. And when I execute any ldapsearch command queries the error is the same: External search command 'ldaptestconnection' returned error code 1. Script output = "error_message= # host: xxx.xx.xx.1: Could not access the directory service at ldaps://xxx.xx.xx.x:636: password is mandatory in simple bind " Even using an admin system role can delete role account with all the required capabilities. Thanks in advance! ... View more

Hello, I need to generate an automatic lookup to match certain hosts for a project i'm working on. the thing is, I have a list of server in my scope, but this list contains sometimes only hostnames, and other times the full FQDN, and that may differ from what I have on my host field on splunk metadata. example of the csv: "host" ,"description" host1, dboraclehost1 host2, dboraclehost2 host3.mydomain.net, dboraclehost3 host4, "host4" host5.dathost,net, "thehost5" and in splunk, on my host field I may have: host1.mydomain.net host5 host3 host4,thedomain.com If that can be achievable via UI would be the best, but I can still do it with the .conf files. best regards! ... View more

Hello, I always have problems ordering my events after evaluating _time to something else. See this query for example: | mybasesearch | eval "Last seen"=strftime(_time, "%d/%m/%Y %H:%M") | morequerytablestuff | sort - _time | fields - _time Here I had to keep _time in my table, sort the events, and then remove the _time field from it. Is there a better way of achieving this? ... View more