Hello Team , I have been working on filtering of some noisy windows event logs from indexing and before doing this in UF , I need to analyze if default ES dashboards and other datamodel related stuff gets impacted ? Main thing I want to know is if I filter 1234 eventcode from indexing , does it impact any field extraction from windows logs for other data getting indexed . any key value pair like user details which extracted from one particular event and used for all logs ? what all eventcodes are ok to filter if anyone can suggest ? ... View more

Hello Team , we have strange issue with the logs we receive from palo alto devices , we have app/addon installed and as i see props.conf file has time zone configured as TZ=GMT for these logs and devices who are sending logs are also in GMT only . Now when i search logs in search head with real time windows it shows correct logs . But if i select logs for last 4 hours 60 minutes etc . it shows alert where event time is delayed by 8 hours. that is last event it shows is 8 hours earlier. when i select all time it will show current event from firewall for eg :- if current time is 2PM UTC then event shown is 2PM and splunk user time it shows is 10 PM PST in the logs listed . I am not sure what is wrong as sourcetypes are having TZ=GMT configured but still looks like splunk is adding 8 hours in it as my splunk servers are in pst. ... View more

i have one csv file which contains device name location data , i need to get count of all the device name location wise. and then i am trying to get malware count and spyware count on the infected machines for one of indexed data as below but this search is not working "" Error in 'stats' command: The argument 'index=abc' is invalid"" if i remove inputlookup first line i will get results but i wont get total no of computers . how should i merge these two requirement . |inputlookup xyz.csv | stats count("Device Name") as Total_Computers by Location index=abc | search TMCM:SLF_INCIDENT |lookup xyz.csv "Device Name" as nodename OUTPUT Location | stats count(nodename) as InfectedComputers count(signature) as MalwareCount count(Spyware) as Spywarecount by Location | table Total_Computers,Location,InfectedComputers, MalwareCount, Spywarecount ... View more

I have a field user= xyz\user11 and i need to match user11 ignoring xyz in the user filed below is the regex expression we have been trying but it gives error as unmatched parenthesis or some other and Result field is not available in the logs if it runs successfully . rex field=user (?\w+\\(\w+)) ... View more

Hello Team , we have requirement to integrete the proofpoint threat response [ TRAP] appliance logs within splunk. i have checked and gone through documentation here and it seems we have options to integrate proofpoint email gateway and tap appliances but it seems there is no info i could find on how to integrate proofpoint Trap within spunk . Kindly help to understand this , may be what i suspect is all logs we can capture using proofpoint email gateway itself and trap integration is not required or there is way to integrate the trap appliances logs , i dont have much idea how proofpoint exactly functions which is causing more confusion Help is appreciated , currently we have proofpoint email gateway and TAP appliances and trap implemented in the organization and we are planning to integrate all 3 with splunk ... View more