Hey all, I was getting confused by some of the splunk answers for converting and couldn't figure out the eval portion of my query. Can someone shed some light on how I can convert the bytes_out field from my palo logs to MB and GB? Query below, thank you in advance! index=pan_logs sourcetype=pan:traffic | stats sum(bytes_out) AS bytes_out by user src_ip dest_ip | where bytes_out>35000000 | sort - bytes_out ... View more

Hello, I'm having some issues with results for "total_pages" and "page_printed" field(s) showing the incorrect print page count. I have enabled the correct stanzas in the inputs.conf file for pulling winprintmon data and I can search it but the results are skewed. As an example, I printed a 4 page doc but in the search results the "total_pages" count is only showing 1 page and the "page_printed" is showing 0 pages. I created a new index just for the print info... search = index=win_print host=printserver user=p_mac22 operation=set search results: operation=set type=PrintJob printer="my printer" machine="my_laptop" user="p_mac22" document="new 1" notify_name="p_mac22" JobId=24 data_type="RAW" print_processor="hpcpp175" parameters= driver_name="HP Universal Printing PCL 6 (v6.0.0)" status="spooling,printing" priority=1 total_pages=1 size_bytes=120 submitted_time="02/20/2019 15:44:34.901" page_printed=0 The ms winevent (event viewer->application and service logs->Microsoft->Windows->PrintService->Operational) eventcode 307 gives the following details: Document 24, Print Document owned by "p_mac22" on "my_laptop" was printed on "my printer" through port "my printer". Size in bytes: 92128. Pages printed: 4. No user action is required. The XML details are: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-PrintService" Guid="{747EF6FD-E535-4D16-B510-42C90F6873A1}" /> <EventID>307</EventID> <Version>0</Version> <Level>4</Level> <Task>26</Task> <Opcode>11</Opcode> <Keywords>0x4000000000000840</Keywords> <TimeCreated SystemTime="2019-02-20T15:44:35.213605400Z" /> <EventRecordID>22345065</EventRecordID> <Correlation /> <Execution ProcessID="796" ThreadID="3336" /> <Channel>Microsoft-Windows-PrintService/Operational</Channel> <Computer>Print Server</Computer> <Security UserID="S-1-5-21-3251799238-2349058309-3148061615-88888" /> </System> <UserData> <DocumentPrinted xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events"> <Param1>24</Param1> <Param2>Print Document</Param2> <Param3>p_mac22</Param3> <Param4>my laptop</Param4> <Param5>my printer</Param5> <Param6>my printer</Param6> <Param7>92128</Param7> <Param8>4</Param8> </DocumentPrinted> </UserData> </Event> Any ideas on how I can either get the correct search data/results for the print jobs or suggestions on what I may have configured incorrectly? Thank you!! ... View more

Hey all, I accidentally installed the latest Splunk add-on for Windows not realizing that it's not compatible with the Exchange app 3.4.1 (or 3.4.4). I reinstalled the add-on for windows v. 4.8.4 but now, if I do source="WinEventLog:Security" in searches or reports, the searches work. But, if I do sourcetype="WinEventLog:Security" it doesn't. The Exchange guided setup is looking for sourcetype="WinEventLog:Security" and saying "sourcetype="WinEventLog:Security" | head 5" did not return any events in the last 24 hours. Any idea on where the source vs. sourcetype issue may reside? (Exchange app, add-on for windows, add-on for AD, add-on for DNS)? My environment is a distributed search head/deployment server and an indexer and I think I have everything aligned but not sure... Any guidance would be greatly appreciated! Thanks! ... View more