If the field is named _time then Splunk will format it automatically. index=dog sourcetype=cat earliest=-30d [| inputlookup LU1_siem_set_list where f_id=*$pick_f_id$* | stats values(mc) as search | eval search="mc=".mvjoin(search," OR mc=")] | stats latest(_time) as _time by ip Otherwise, you can use the convert command to format it. index=dog sourcetype=cat earliest=-30d [| inputlookup LU1_siem_set_list where f_id=*$pick_f_id$* | stats values(mc) as search | eval search="mc=".mvjoin(search," OR mc=")] | stats latest(_time) by ip | convert ctime('latest(_time)') ... View more

FIPS has to be turned on before starting Splunk.  If you've already started Splunk then you'll have to remove it and re-install it.  See https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/SecuringSplunkEnterprisewithFIPS ... View more

Other attributes that *may* distinguish a report include alert.track and alert_condition, but I've found alert_type to be the best. You won't find this information documented.  It's tribal knowledge and now you're part of the tribe.  🙂  Seriously, you can use your browser's console to view the REST commands sent for the UI's Searches, Reports, and Alerts dashboard to see how the two types are differentiated. ... View more

That endpoint returns information about all saved searches in all apps.  See the REST API Reference Manual for an explanation of the data returned. Note that reports and alerts are both saved searches.  Reports are distinguished by the attribute alert_type=always, but there may be other indicators. ... View more

The force_local_processing setting in props.conf will have the UF do some parsing.  See props.conf.spec for details. ... View more

Check for the existence of a field with the isnotnull() function. eval Error=case(isnotnull(attr.error), 'attr.error', isnotnull(attr.error.errmsg), 'attr.error.errmsg') or use the coalesce() function, which does the tests for you and selects the first listed field that is not null. eval Error=coalesce('attr.error','attr.error.errmsg')   ... View more

When the retention period is reduced, any buckets where all data is older than the new retention period will be frozen.  When archiving is enabled, freezing buckets means moving them to archive storage. ... View more

If the lookup table is small enough, you may be able to update it manually using the Splunk App for Lookup File Editing (https://splunkbase.splunk.com/app/1724). Otherwise, the only way to do it in SPL is to read the entire lookup table, modify the status field using eval or other commands, and then rewrite the lookup table. | inputlookup Status.csv | eval status=... | outputlookup Status.csv   ... View more

I believe you have to use the full name of the field ("entry.name", for example). ... View more

CIM-compliance is different and has nothing to do with whether a field can be used in the tstats command.  CIM-compliance means a field has a name and value described in the CIM manual (https://docs.splunk.com/Documentation/CIM/5.3.2/User/Howtousethesereferencetables). The only fields the can be used in tstats are those created at index-time or those in an accelerated datamodel. ... View more

The tstats command only works with indexed fields.  If the field is not indexed and is not in a data model (same thing, really), then it can't be used with tstats. ... View more

The rex command defaults to the _raw field.  Other fields must be explicitly referenced.  The following works in my sandbox. | makeresults | eval message="<UL> <LI> The first vulnerability occurs because Internet Explorer does not correctly determine an obr in a pop-up window.</LI> <LI> The t type that is returned from a Web server during XML data binding.</LI> </UL> <P> &quot;Location: URL:ms-its:C:WINDOWSHelpiexplore.::/itsrt.htm&quot; <P> :<P><A HREF='http://blogs.msdn.com/embres/archive/20/81.aspx' TARGET='_blank'>October Security Updates are (finally) available!</A><BR>" | rex field=message mode=sed "s/\<[^\>]+>//g"   ... View more

To get a count, replace the dedup command with stats.  Since the stats command sorts it results, you don't need the separate sort command. index=cisco sourctype=cisco:asa message_id=XXXXXX | stats count by host, src_ip, dest_ip, dest_port, action | table host, src_ip, dest_ip, dest_port, action count   ... View more

I don't really have a solution.  I was going to suggest multiple white lists, but you said that didn't work for you. Also, you want to filter on AccountName and ObjectName, but those fields are not supported by whitelist/blacklist.  See https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Inputsconf#Event_Log_allow_list_and_deny_list_formats for the list of supported fields. Consider ingesting the Windows events in XML format and filtering them using the $XmlRegex key.  See https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowseventlogdata#Use_allow_lists_and_deny_lists_to_filter_on_XML-based_events for more information. ... View more

There are no legitimate practice exams.  Use the blueprint (https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-user.pdf) to prepare.  It will tell you what subjects are on the exam and then you can use other Splunk resources, including free training, to learn those subjects. ... View more

The whitelist value must be a list of event IDs or one or more key=regex expressions.  The current value is just a regular expression, which is not supported. ... View more

Here's a query that will find most KOs owned by inactive users.  You may want to enhance it to also look for lookups.  Of course, change the '90' to whatever value you deem to be 'inactive'. | rest splunk_server=local /servicesNS/-/-/admin/directory | fields title eai:acl.app eai:acl.owner eai:type eai:acl.sharing | rename eai:acl.* as * | where (owner!="nobody" AND owner!="admin") | search [| rest splunk_server = local /servicesNS/-/-/admin/users | fields title last_successful_login | eval lastLogin = if(isnull(last_successful_login) OR last_successful_login=0,"never", strftime(last_successful_login, "%c")) | eval idleDays = round((now()-last_successful_login)/86400,0) | where (idleDays > 90 OR lastLogin = "never") | fields title | rename title as owner | format] ... View more

Tell Splunk which field to extract from by using the in option. EXTRACT-service = [^:]+:[^:]+:(?<service>.+)$ in source   ... View more

It looks like the app was not re-packaged properly on the Linux box.  Perhaps an extra directory level was added. ... View more

Ubuntu on Windows is still Windows.  I had the same problem.  You have to use a real Linux box. ... View more