Hello, I have some logs with a common field and I'd like to correlate them. here my first event: 26/02/2020 16:34:21|toto|test|600|440|Session End|device=titi|sessionId=3bee772f147|ext=External Here my second one: 26/02/2020 16:34:21|toto|test|600|440|Upload|sessionId=3bee772f147|ext=External|username=mvag So, my question is how can I extract the username when the sessionid is the same for the two events by searching the "Session End" information (first event)? The main idea is to search the "Session End" information and find the username where the sessionId is the same. Thank you in advance. Michael p.s: It would be better if the device manufacturer had added the username in each event but it would be so easy 🙂 ... View more

Hello all, I have again something strange with my logs, the milliseconds in the _time field are not detected despite the applied props.conf parameters. Here how it looks every line of my log: 1234 08/08/2019 15:08:56:924 123456789 0000049T6 TOTOPROCESS INF TOTO settings - process timeout set to 70 s Here my props.conf: [mysourcetype] TIME_PREFIX =^\d+\s\d{1,2}\/\d{1,2}\/\d{4}\s\d{1,2}\:\d{1,2}\:\d{1,2}\:\d{1,4}\s TIME_FORMAT = %d/%m/%Y %H:%M:%S:%3N MAX_TIMESTAMP_LOOKAHEAD = 29 TZ = GMT BREAK_ONLY_BEFORE =^\d+\s\d{1,2}\/\d{1,2}\/\d{4}\s\d{1,2}\:\d{1,2}\:\d{1,2}\:\d{1,4}\s I tried all the possible solutions that I could find in the forum but nothing works. The timestamp shows always three zeros for the milliseconds. 8/8/19 3:08:56.000 PM I tried also by disabling the time_prefix, changing the time_format parameters,etc, but nothing helps. At the beginning I thought that the props.conf were not being applied but I changed the "TZ" parameter (for testing purposes) and it was immediately applied so I don't think that the UF ignores my configuration. I don't have any solution for the moment and any suggestion is welcome. Thank you in advance. Michael ... View more

Hello Splunkers, I searched to find the answer but I couldn't find the solution in answers.com. I'm sorry if my research wasn't good enough and the answer exist already. I want to send logs of OFFICESCAN in splunk and the only ways is through the windows event logs. So the format is an XML and so a lot of important fields are not extracted. Below an example of my log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Serveur Trend Micro OfficeScan'/><EventID Qualifiers='49157'>500</EventID><Level>3</Level><Task>5</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2019-05-09T07:36:32.451876000Z'/><EventRecordID>134998</EventRecordID><Channel>Application</Channel><Computer>myserver.dom</Computer><Security UserID='S-1-5-18'/></System><EventData><Data>Virus/programme malveillant : TrojanSpy.Win32.NEGASTEAL.THDCOAI Ordinateur : infected_server Domaine : xxx\yyy_toto_20h\ Fichier : C:\xxxxxx\yyyyyyy-zzzzzzzz\AppData\Local\Temp\yyyyyyyy_892E\blabla blabla(~174 KB).rar (blablalbla(~174 KB).exe) Date/heure : 09/05/2019 09:36:06 Résultat : Quarantaine </Data></EventData></Event> What I need is between the that is to say the values like "fichier", "Résultat" etc. When I'm testing my regex command sur https://regex101.com/ the command is working well but once in splunk it doesn't work anymore. For exemple I tried this command in order to extract the "domaine" value: Domaine\s\:\s(?P<Domaine>([^\s]+)) I tried in splunk to use the "| xmlkv" function but it only extracts the "data" content but not the fields contained in it; I think it is a normal behaviour. So, I suppose that I need a specific command to do this extraction, or I missing something in my regex. Do you have any suggestion please? I thank you in advance. have a great day. Michail ... View more

Hello all, I have a "problem" with a new indexer added in my cluster. My cluster has two indexers. The goal is to replace these two indexers by two other with more resources. So here what I did: 1) realize all the configurations in indexes.conf, server.conf etc 2) add the new indexer in my cluster 3) shut down and remove from the cluster the old indexer 4) wait for the replication finishing. The problem is that, once replication finished, I have an important number of buckets that missing. My new server in the cluster has 9500 buckets and the old one, 11500. When I launch a research for the same time period on the same index but on the new and the second old server, I don't have the same number of results. I tried the "data rebalance" but nothing...everything is green in the Master node under Indexer clustering. Is there anyway to force the missing bucket replication? edit: I've just realized that the problem was already there before the addition of the new server. The removed server has lowest bucket number and lower events in the indexes. Thank you in advance. Michael ... View more

Hello everyone, since a while, I cannot see my license usage for more than 7 days. At the beginning I thought that it was a bad setting on my _internal index that could drop the data over the 7 days period but I was mistaken. I saw that beyond 7 days, there is no source like in my _internal index license_usage.log I double verified all my *.conf files but no parameter that could delete data. My infrastructure consists of: 1 SH 4 Idxs 1 Master Do you have any idea that could explain this phenomenon? thank you in advance Michael ps: master and SH forwarding data to the indexers ... View more

Hello Splunkers, I have a problem when I'm searching in _internal index from my master server. My architecture consists a master server et four indexers. When I search index=_internal on my master server I have results only from my indexers but not from the local server. If I specify in my search the name of my local server index=_internal splunk_server=master then it works and I have all the results. I discovered that when I tried to check my license usage for 30 days that was empty. However, the "today" license usage works perfectly. I have this problem since last week but I didn't change anything on my servers during this period. I verified privileges and ownership in /opt/splunk but everything is ok. My user is admin and can access all indexes, full access. All my config files are consistent and no error found when I run the debug command splunk cmd btool check Do you have any ideas ? Thank you in advance Michael ... View more