Hello. Information related about JDBC drivers: https://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Installdatabasedrivers#Supported_databases ... View more

Hello. Go to Settings -> Access Control -> Roles. You got to make sure you don't have any special character in the names. In my case I used to have a "Ñ". I changed the name and I solved the problem. I hope it helps. ... View more

I have found a problem with strange characters in rol names. I have a "ñ" into rol name and I think that's the problem. I'm going to change and I will tell you. ... View more

After set up in DEBUG mode I got this error: 2019-09-10 09:10:47,400+0000 ERROR pid=1382 tid=MainThread file=confcheck_es_migrate_reviewstatus_transitions.py:run:201 | () {'sessionKey': u'wEm^h1QMMujbz3PLPZUT93GAxUZT7TXSv7stcoP7xG5oSO9Vbk_^32Foo4s6^SnI8IAA9P1Vh4vPCpTmHw^uEKnmYVD7tBmkz6A8OzcEX6LEiOSyFuNCpwtauN', 'checkpoint_dir': u'/opt/splunk/var/lib/splunk/modinputs/configuration_check', 'namespace': 'SplunkEnterpriseSecuritySuite', 'data': {u'last_run': 1568041761.104844}} Traceback (most recent call last): File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 177, in run role_transitions = getTransitionsToMigrate(sessionKey) File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 56, in wrapper raise TransitionsMigrationException(e, level, message) TransitionsMigrationException ... View more

In "Configure->Configuration Checker -> confcheck_es_migrate_reviewstatus_trasitions" you can set in DEBUG mode. I am going to wait until I get a new warning. ... View more

Hello, have you solved this? I found an ES in the same situation and I don't know what to do. ... View more

No, I want to filter DB="INSTANCE_TO_FILTER" which in this case had a CONNECTION_ID="222222", and all the events which has CONNECTION_ID="222222". Then if there is another event DB="INSTANCE_TO_FILTER" with CONNECTION_ID="333333" I want to filter all the events with CONNECTION_ID="333333" That is why your filter does not work for me because it is going to filter only the event with DB="INSTANCE_TO_FILTER" but it won't filter the other ones. ... View more

Hi. I have been reading about that and I think I cannot filter in that way. I have three different events: AUDIT_RECORD TIMESTAMP="2019-07-12T02:54:30 UTC" RECORD_ID="91203630_2019-07-12T02:54:30" NAME="Query" CONNECTION_ID="**222222**" STATUS="0" STATUS_CODE="0" USER="myuser[mydb] @ [1.1.1.1]" OS_LOGIN="" HOST="" IP="1.1.1.1" COMMAND_CLASS="set_option" SQLTEXT="SET NAMES latin1" AUDIT_RECORD TIMESTAMP="2019-07-12T02:54:30 UTC" RECORD_ID="91203631_2019-07-12T02:54:30" NAME="Query" CONNECTION_ID="**222222**" STATUS="0" STATUS_CODE="0" USER="myuser[mydb] @ [1.1.1.1]" OS_LOGIN="" HOST="" IP="1.1.1.1" COMMAND_CLASS="set_option" SQLTEXT="SET character_set_results = NULL" AUDIT_RECORD TIMESTAMP="2019-07-12T02:54:30 UTC" RECORD_ID="91203632_2019-07-12T02:54:30" NAME="Connect" CONNECTION_ID="**222222**" STATUS="0" STATUS_CODE="0" USER="myuser" OS_LOGIN="" HOST="" IP="1.1.1.1" COMMAND_CLASS="connect" PRIV_USER="myuser" PROXY_USER="" DB="**INSTANCE_TO_FILTER**" I want to filter all the events with DB="INSTANCE_TO_FILTER", which in this case has an CONNECTION_ID="222222", but it's difficult because are different events. ... View more

Hello @gcusello. It is like the comments. I filtered logs in the past, in the HF and the indexer. But I mean in the specific case I post in the question. I cannot. ... View more

Yes, there are different events. But in this case they have in common the CONNECTION_ID field. ... View more

Hello, thanks for your answer. I think I did not explain properly. This configuration will filter the event: AUDIT_RECORD TIMESTAMP="2019-07-12T02:54:30 UTC" RECORD_ID="91203632_2019-07-12T02:54:30" NAME="Connect" CONNECTION_ID="**222222**" STATUS="0" STATUS_CODE="0" USER="myuser" OS_LOGIN="" HOST="" IP="1.1.1.1" COMMAND_CLASS="connect" PRIV_USER="myuser" PROXY_USER="" DB="**INSTANCE_TO_FILTER**" But it won't filter these one: AUDIT_RECORD TIMESTAMP="2019-07-12T02:54:30 UTC" RECORD_ID="91203630_2019-07-12T02:54:30" NAME="Query" CONNECTION_ID="**222222**" STATUS="0" STATUS_CODE="0" USER="myuser[mydb] @ [1.1.1.1]" OS_LOGIN="" HOST="" IP="1.1.1.1" COMMAND_CLASS="set_option" SQLTEXT="SET NAMES latin1" AUDIT_RECORD TIMESTAMP="2019-07-12T02:54:30 UTC" RECORD_ID="91203631_2019-07-12T02:54:30" NAME="Query" CONNECTION_ID="**222222**" STATUS="0" STATUS_CODE="0" USER="myuser[mydb] @ [1.1.1.1]" OS_LOGIN="" HOST="" IP="1.1.1.1" COMMAND_CLASS="set_option" SQLTEXT="SET character_set_results = NULL" I want to filter the block, in this case "INSTANCE_TO_FILTER" has the CONNECTION_ID=222222 and I want to filter all the events that have CONNECTION_ID=222222. ... View more

I had an experience similar to you and I finally had to modify the script who generates the json to avoid using arrays. I mean json like this: [ { [-] created_at: 2019-08-28T13:48:48.722Z credibility_score: -5 email: swathi.nandigam@xx.ae id: 625 last_reported_at: 2019-08-28T13:52:48.000Z reports_count: 1 updated_at: 2019-08-28T13:48:51.519Z vip: false } { [-] created_at: 2019-08-28T04:46:22.106Z credibility_score: 0 email: richard.talian@xx.ae id: 624 last_reported_at: 2019-08-28T04:48:36.000Z reports_count: 1 updated_at: 2019-08-28T04:46:24.169Z vip: false } ] It did not work for me. I had to remove the array and had json like this: { [-] created_at: 2019-08-28T13:48:48.722Z credibility_score: -5 email: swathi.nandigam@xx.ae id: 625 last_reported_at: 2019-08-28T13:52:48.000Z reports_count: 1 updated_at: 2019-08-28T13:48:51.519Z vip: false } { [-] created_at: 2019-08-28T04:46:22.106Z credibility_score: 0 email: richard.talian@xx.ae id: 624 last_reported_at: 2019-08-28T04:48:36.000Z reports_count: 1 updated_at: 2019-08-28T04:46:24.169Z vip: false } The the sourcetype _json worked perfectly. ... View more

I did it and I'd rather this answer. I worked for me. ... View more

Could you send your XML? ... View more

Can you use "fields"? For example: fields New_Page, Old_Page_Load, Exit_Page Or which conditions do you have? ... View more

Hello @FrankVl, this is exactly what I need. Thank you so much for your reply and your time. ... View more

Hello @FrankVI. This is closer for what I want. The AND is OK, how can implement the OR and the XOR. If I can implement only the OR it will be ok because I can simulate the XOR with AND's and OR's. ... View more

Hi @bangalorep, thank your for your reply and your time. What I really want is to use boolean math in Splunk. I represented the function like Splunk did, for example: A OR B in boolean maths is (A + B) but 1 + 1 is not 2, 1 + 1 in boolean maths is 1 A AND B in boolean maths is (A*B), in this case any value multiply by 0 is always 0. but if I want to represent the function: A = 1 B = 1 C = 1 D = 1 F = (A * B) * (C + D) or in Splunk syntax F = (A AND B) AND (C OR D) I cannot do it in Splunk. If I do it like arithmetic operators I will have: F = (1 * 1) * ( 1 + 1) = 2 But I want the boolean math, I only want a result like 0 or 1, nothing else: F = (1 * 1) * (1 + 1) = 1 or F = (1 AND 1) AND (1 OR 1) = 1 Yes, I know I can use the where syntax but I want to make boolean operations in Splunk like I do a single arithmetic operation. ... View more

Hi @bangalorep. This is the macro query I did. A AND B will be a result from other conditions, but it always be a boolean value, in my case I use 0 AND 1 but it can be TRUE OR FALSE. This is the complete query I used. inputlookup cve-vul-alienvault-lookup-usa | eval CurrentCycle="20180201" | eval cycle_detection_time=strptime(CurrentCycle,"%Y%m%d") | eval Cycle1monthago = strftime(relative_time(cycle_detection_time,"@month-1month"),"%Y%m%d") | where cycle_detection = CurrentCycle OR cycle_detection=Cycle1monthago | eval A = if(Auth = "AuthOK" AND cycle_detection=Cycle1monthago,1,0) | eval B = if((Auth = "AuthOK" OR Auth="NULL") AND cycle_detection=CurrentCycle,1,0) | eventstats sum(A) as A , sum(B) as B, count by id,dest_ip | eval F = if(A=1 AND B=0,1,0) | where F=0 | eval IsResolved = case ((count = 2 AND cycle_detection=CurrentCycle),"Not Resolved",(count=1 AND cycle_detection=Cycle1monthago),"Resolved", count=1 AND cycle_detection=CurrentCycle,"New Vulnerability") | fields id,dest_ip,cycle_detection,os,signature,type,cvss,cve,Resultados,IsResolved The problem is now solved with they query I have because I only have 4 combinations of values between A AND B. A = 0 AND B = 0 A = 0 AND B = 1 A = 1 AND B = 0 A = 1 AND B = 1 I want the result of all combinations except when A = 1 AND B = 0 so I decided to call the result as F, F will be 1 if I want to ignore the result and 0 if I want to keep it so I will have something like this: A = 0 AND B = 0 so F = 0 A = 0 AND B = 1 so F = 0 A = 1 AND B = 0 so F = 1 A = 1 AND B = 1 so F = 0 The mathematical functions which represents what I wanted is: F = (A AND BNEGATED) this is the same logic we use in electronic circuits. So if I receive these values in the results: A = 1 AND B = 1 Then BNEGATED = 0 so F = (1 AND 0 ) then F = 0 if I received these values A = 1 AND B = 0 Then BNEGATED = 1 so F = (1 AND 1) then F = 1 There are two ways (Maybe more but I don't know and I'll be able to receive any recommendation) I can solve this problem, the fist one is like the previous query: | eval F = if(A=1 AND B=0,1,0) | where F=0 That logic is OK because I only have two variables to compare and I only have 4 combinations available but I really want to use the boolean function like logic circuits in electronic components. | eval NEGATEDB = if(B=0,1,0) | eval F = A AND NEGATEDB | where F=0 Why I want to work this way? Because in this case I only have 2 variables (A and B) and only 4 combinations but in the future I'm planning to have 4 variables (maybe more) and then I will have 16 combinations of values so I don't want to use a case, I think a function is the best way (I might be wrong). For example in the case with 3 variables I have this function: F = B AND C AND ( A OR ANEGATED) so when A = 1, B = 0, C= 1 I will have: F = 0 AND 1 AND (1 OR 0) = 0 AND 1 AND 1 = 0 . This is going to be OK if A = 1, B = 1, C =0 I will have: F = 1 AND 1 AND (1 OR 0) = 1 AND 1 AND 1 = 1. Splunk will filter this value because I want results when F=0 In short words I want to work with Boolean values like arithmetic values: eval V = X/t where V >= 100 At the moment I don't know how to or if it's possible. I hope I did not confused anyone hehehe and I also did not focus in A and B values, the A and B values will always be 0 or 1. Those values come from other conditionals but will be 1 or 0. ... View more

Hi, as I see you are trying to install Splunk on MacOS right? You should follow these steps: http://docs.splunk.com/Documentation/Splunk/7.0.1/Installation/InstallonMacOS ... View more

Hi garethatiag, I exported the data via CLI but I always had the problem with jobs expiration because time is too short. My solved was editing the job settings manually and extend the lifetime, it was ok at the moment I needed but If I want something more automatically it's not the best choice. I changed the TTL in those files and I did not get what I wanted, when I used the CLI the job time expiration was too short. I used to export 200GB of data. ... View more