Hello! I try to build some complex search. We try to build correlated search, which user ran the application and on what host. We using paloalto log to find apps and src_ip, Windows Security logs to find User and src_ip and DHCP Logs to find hostname on src_ip We have recieved event from PALO ALTO firewall. _time src_ip apps We have recieved event from wineventlog:Security, what user was logged on to the machine with SAME ip We have collect DHCP Logs to find Hostname by ip-address. My search: sourcetype=pan_traffic | join src_ip type=outer [search index=wineventlog EventCode=4624 | dedup user | join dest [search sourcetype=DhcpSrvLog signature="DNS dynamic update successful"] | rename dest AS dest_name | rename dest_ip AS src_ip] | table generated_time,log_subtype,src_ip,application,dest_name,user This search not correct, because it search last login user on the host. I think, we must to compare "generated_time" with user login time. So we must to find intervals, when user login by host. I think we must to use transaction. So search: sourcetype="WinEventLog:Security" EventCode=4624 OR EventCode=4634 action=success | dedup _time | eval User=if(mvcount(Account_Name)>1, mvindex(Account_Name,1), mvindex(Account_Name, 0)) |eval User=lower(User)| search NOT User=*$ | transaction User maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 | eval timeend=_time+duration | convert timeformat="%y-%m-%d %H:%M:%S" ctime(timeend) AS logoff_time | table User,_time,logoff_time But how how to find online users?? And by host?? So, how to find intervals, when user online (and find current ONLINE users) and build table: generated_time,log_subtype,src_ip,application,dest_name,user Thanks. P.S. sorry for my English ... View more

Hello! I have two source. First is IPS, second is ASA. I want to find unique IP address ("dest_ip") with signature 2245 OR 2700. My query is: sourcetype="snort" 2245 OR 2700 | dedup dest_ip | table dest_ip And now, i want to find events with this unique IP addess in ASA log. In ASA log IP called "srcip". sourcetype="asa" | append [search sourcetype="snort" 2245 OR 2700 | dedup dest_ip | table dest_ip] | where srcip=destip I think it is very simple, but I cannot find any answers and solutions to my question. 😞 Thank in advance! ... View more

Hello! I delete splunk using: rpm -e splunk rm -r /opt/splunk After i download splunk-6.0.3-204106-linux-2.6-x86_64.rpm and install: rpm -i /tmp/splunk-6.0.3-204106-linux-2.6-x86_64.rpm Installtion is complete. When I use /opt/splunk/bim/splunk start, I have error: Splunk rev. 9.11.2013 Do you agree with this license? [y/n]: y This appears to be your first time running this version of Splunk. Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py", line 18, in import control_api as ca File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/control_api.py", line 23, in import i18n File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/i18n.py", line 7, in from babel.messages import frontend File "/opt/splunk/lib/python2.7/site-packages/babel/messages/frontend.py", line 36, in from babel.messages.extract import extract_from_dir, DEFAULT_KEYWORDS, \ File "/opt/splunk/lib/python2.7/site-packages/babel/messages/extract.py", line 70, in def extract_from_dir(dirname=os.getcwd(), method_map=DEFAULT_MAPPING, OSError: [Errno 2] No such file or directory How can i solve this problems? ... View more

Hello! I have some problems with splunk-cluster. I have 1 ClusterMaster, 2 Inexer, 1 SearchHead. Replication factor = 2, Search factor = 2. SF and RF is not met. In my mind, cluster donot work, but i can't understand, why? In log i have much error: 03-28-2014 15:01:53.653 +0400 ERROR TcpInputProc - event=replicationData status=failed err="Could not open file for bid=svzn-sms~10~3BBEA949-B697-405F-8F7C-84F8280EB5D9 err="index=svzn-sms Could not load configuration" (Success)" In my mind, cluster donot work, but i can't understand, why? P.S. I read much "answers" and manual... ... View more

Hello! I want to upgrade my Splunk 5.0.5 to 6.0. I copied files to directory with Splunk, but when i try to START Splunk, I have error: couldn't run "/opt/splunk/bin/python": Exec formar error Can anyone help me? P.S. OS=ubuntu 12.04 x86 ... View more

Hello! I adds TCP Data Inputs and indexes the TCP port 80. I use local forwarder and indexer. How can i search this logs? What sourcetype? Syslog? Sorry, but i can`t find answer.. ... View more