You will need to use stats in combination with eval to calculate a sum of the bytes for download traffic and non-download traffic. Hopefully there is a key in your data that will help you differentiate. Here is an example index=foo | stats sum(eval(if(action="download", TotalMB, NULL))) AS download_traffic sum(eval(if(action!="download", TotalMB, NULL))) AS other_traffic by src_ip For reference: https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Usestatswithevalexpressionsandfunctions ... View more

The field should be parsing by default. Do you have the Splunk TA for Windows installed on the Search Head (Link: https://splunkbase.splunk.com/app/742/)? If so, this search should work: index=<<your_index>> source="WinEventLog:security" EventCode=4738 Account_Expires="<never>" ... View more

You would need to modify the value of SPLUNK_BINDIP in $SPLUNK_HOME/etc/splunk-launch.conf: https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Splunk-launchconf SPLUNK_BINDIP=<ip address> * Specifies an interface that splunkd and splunkweb should bind to, as opposed to binding to the default for the local operating system. * If unset, Splunk makes no specific request to the operating system when binding to ports/opening a listening socket. This means it effectively binds to '*'; i.e. an unspecified bind. The exact result of this is controlled by operating system behavior and configuration. * NOTE: When using this setting you must update mgmtHostPort in web.conf to match, or the command line and splunkweb will not know how to reach splunkd. * For splunkd, this sets both the management port and the receiving ports (from forwarders). * Useful for a host with multiple IP addresses, either to enable access or restrict access; though firewalling is typically a superior method of restriction. * Overrides the Splunkweb-specific web.conf/[settings]/server.socket_host param; the latter is preferred when SplunkWeb behavior is the focus. * Defaults to unset. Be careful when modifying this variable. Certain apps that store credentials for modular inputs often try to retrieve those credentials by hitting REST endpoints on localhost. If Splunk isn't bound to localhost it could cause the modular inputs to fail. ... View more

You could try and decode it at search time with the urldecode eval function: https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/TextFunctions ... View more

You will need to set a token on the drilldown and then create another panel that is dependent on that token, in other words it wont be visible until you click on one of the apiproxy.name fields. Here is some example code (you may need to modify it depending on whether or not you want a line chart etc.): <panel> <table> <title>API Proxy List</title> <searchString>index=apigee host=$envselect$ | stats count by apiproxy.name</searchString> <earliestTime>$APITime.earliest$</earliestTime> <latestTime>$APITime.latest$</latestTime> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <drilldown> <set token="showChart">$row.apiproxy.name$</set> </drilldown> <option name="count">50</option> </table> </panel> <panel depends="$showChart$"> <title>$showChart$</title> <chart> <search> <query>index=apigee sourcetype=_json "apiproxy.name"=$showChart$ | timechart span=1m avg(latencyTarget) avg(latencyProxy) avg(latencyTotal)</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> </chart> </panel> You can do most of this through the UI, here is the link to the docs: https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/ContextualDrilldown ... View more

You should be able to do this with the date_hour & date_wday fields. You should just need to add this to the first part of your search: date_hour>=0 date_hour<12 (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR date_wday=friday) Full query index=dcsdjc host=awer THREAD_WALL_MS!=null date_hour>=0 date_hour<12 (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR date_wday=friday) | bin _time span=1h | streamstats count as Req by host, _time | eval RequestsPerMin=Req/60 | eval RequestsPerSec=RequestsPerMin/60 | stats avg(RequestsPerMin) as AvgRequestsPerSec, max(RequestsPerMin) as MaxRequestsPerSec, p95(RequestsPerMin) as P95RequestsPerSec by host |eval AvgRequestsPerSec=round(AvgRequestsPerSec,2), MaxRequestsPerSec=round(MaxRequestsPerSec,2), P95RequestsPerSec=round(P95RequestsPerSec,2)|sort -MaxRequestsPerSec, - P95RequestsPerSec ... View more

Streamstats and the time_window parameter could be useful here. Something like this base_search | streamstats time_window=1m dc(command) AS unique_commands values(command) AS commands_executed by user host | sort - unique_commands You could look for it happening on multiple systems by adding eventstats to it with something like this: base_search | streamstats time_window=1m dc(command) AS unique_commands values(command) AS commands_executed by user host | where unique_commands>4 | eventstats dc(host) AS unique_hosts by user | sort - unique_hosts That should at least get you pointed in the right direction. Here is the streamstats and eventstats docs for reference. They will be pretty useful for use cases such as these Streamstats: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Streamstats Eventstats: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Eventstats Also a cool blog: https://www.splunk.com/blog/2014/04/01/search-command-stats-eventstats-and-streamstats-2.html ... View more

True, you dont have to add the domain_match field. You could change the lookup command as @starcher suggested. Just a preference of mine ... View more

Since some of the old entries in the existing lookup are using the old definition of date_last_seen it wont work with the data math since they are strings. You will need to purge those manually for now. Going forward the date math will take care of everything ... View more

I would definitely distribute the configuration with an app from the Cluster Master. https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Managecommonconfigurations ... View more

One thing to consider is the increased load the DMA searches will to the non-ES indexer and the possibility of data from that system being added to your datamodel summaries (which may or may not be desirable). This could be avoided if you have your cim_* macros tuned to only include the specific indexes that contain data relevant to that datamodel, provided there isn't an index with the same name configured on the non-ES indexer. ... View more

As @nickhillscpl said, The Splunk Enterprise Security Content Updates App has some great use cases around cross-account activity, cryptomining, user activity, provisioning activity, NACL etc. Here is the link: https://splunkbase.splunk.com/app/3449/ ... View more

Are you collecting all of the linux logs with a syslog server? If so, you could have you syslog server write the incoming data out to a directory with one of the parent directories labeled as the source IP. Then you could parse out the source IP from the source field in Splunk ... View more

You will need to look at how hosts are logging in your environment and how far off the timestamp of the last event sent by each host is from the current time. Here is a query that will help with that | metadata type=hosts index=* | eval time_zone_diff = Now() - lastTime | eval recent_time = Now() - recentTime | sort time_diff Hosts with a negative value for the time_diff field are sending data that is "in the future" compared to the clock of your Splunk Servers. This indicates hosts with a time zone that are ahead of the time zone of your splunk infrastructure. Hosts with a high value for time_diff and a low value for recent_time indicate hosts with a time zone that are behind your Splunk infrastructure. Here is the metadata doc for reference: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Metadata Time zone docs for help with remediation: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Applytimezoneoffsetstotimestamps ... View more