We have a bunch of servers with UFs installed. These servers may have different operational states. For example, "Active", "Build in Progress", "Decommissioned", and "Decom in Progress". We use ServiceNow for the asset inventory. This is the search query used to determine the version of the UFs installed. index=_internal source=*metrics.log component=Metrics group=tcpin_connections | dedup hostname | table hostname sourceIp os arch version I would like to be able to get the Active servers that have splunk UF installed and NOT reporting to splunk. Also, looking for a way to dynamically update the list of Active servers, as this list changes whenever there are new servers onboarded or old servers decommissioned. I've looked at the Splunk App/Add-on for ServiceNow and could not find an option to do this. I've also looked at https://docs.splunk.com/Documentation/Splunk/7.3.1/DMC/Configureforwardermonitoring, but am not sure how to go about configuring it to dynamically update the asset list with the Active servers. Any help will be much appreciated. ... View more

I am attempting to anonymize clear-text credentials passed via PowerShell referring to the splunk documentation to Anonymize_data_with_a_sed_script In the inputs.conf I have... sourcetype = WinEventLog:Microsoft-Windows-PowerShell/Operational In props.conf I have... [WinEventLog:Microsoft-Windows-PowerShell/Operational] SEDCMD-ps_logs_mask_cred = s/-ScriptBlock*/xxxxxx/g I have attempted to mask just the password and the credential, but could not get it to work. I am able to do this partially via sed or perl on a linux command line, but have not been able to replicate on splunk. Sample data Invoke-Command -computername somePC -ScriptBlock {get-something -password 'som3_verY-Long_Pa$$w0rd'} -Credential somedomain\someuser Expected output (masking the entire ScriptBlock) Invoke-Command -computername somePC xxxxxx Or more appropriately, masking only the password and Credential Invoke-Command -computername somePC -ScriptBlock {get-something -password 'xxxxxx'} -Credential xxxxxx Any help will be much appreciated! ... View more

I am attempting to extract the share names from the "pluginText" field below. pluginText: <plugin_output> Here are the SMB shares available on the remote host when logged in as SomeAccount: - share1$ - Share-2$ - share 3 - share number 4 - share - number - 5 - and_so_on </plugin_output> and require the out put to show like this... share1$ Share-2$ share 3 share number 4 share - number - 5 and_so_on I had some luck with this... | rex ":* - (?<pluginText>[^<]*)</plugin_output>" | makemv delim=" - " pluginText ... with the exception of share names that contained a " - ". For example, " share - number - 5" gets split into three separate names because of the delimiter. I've also tried this... | rex "^[^\-\n]*\-\s+(?<pluginText>[^<]*)" | makemv delim="\n - " pluginText But it's not consistent. Sometimes, I get the share names as intended, and sometimes it just shows all the text including whats not required. I'm not very strong with regular expressions, so I'm requesting help to get it right on splunk. ... View more