I would add that it's likely license usage would be greater for syslog ingested as HEC (being json) vs ingested as old school text log files. In that sense, SC4S would likely cause greater license usage than syslog, though you would save local disk capacity from having to store files until ingested. Just compare a text log file to it's json equivalent. ... View more

The csv lookup at index time is only to ingest  a csv and would not help in this case.  The iplocation command in SPL is actually a scripted lookup, but just like your scripted lookup suggestion, would still be at search time and would not help in this case.  ... View more

Each data source is different, but I noticed you tagged this for Windows so I'll post this guide: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/Admin/WindowsGDI#Overview Essentially you login to the Splunk Cloud Search Head, download the Universal Forwarder app and you distribute that app to the /opt/splunkforwarder/etc/apps/ directory of the machines you want to send data to the Cloud. Depending on your needs and network architecture, it could get more complicated, but that is the simple version. So each Windows Server would need a Splunk UF (Universal Forwarder) and the Spunk Cloud UF app/ta/add-on (TA stands for Technical Add-on) to be able to send and collect data. Each data source also needs a configuration telling it what data to collect. This is often achieved by using a Splunk TA aka add-on on Splunkbase: https://splunkbase.splunk.com/ You can download the Splunk UF here: https://www.splunk.com/en_us/download/universal-forwarder.html For larger environments, the UF and required addons are usually distributed via a Splunk Deployment Server. Also, often data is sent through one or more Forwarders before Cloud to minimize firewall rules, or depending on your network architecture needs. All data sources need to be able to send data via tcp/9997 to Splunk Cloud. So the breakdown of steps is: Create an index on Splunk Cloud to receive your data Download the Cloud TA (called Cloud Universal Forwarder) from Splunk Cloud Search Head Install a UF and the Cloud TA onto your data source The Cloud TA needs to be untar'd to /opt/splunkforwarder/etc/apps/ Or it can be distributed via Splunk Deployment Server Install one or more add-ons aka TAs to /opt/splunkforwarder/etc/apps/ Configure and enable one or more 'inputs' or data to send by editing the inputs.conf within each TA/add-on There is usually a template inputs.conf in the default folder of each add-on. Create a /local folder (same level as /default) in each TA and copy that inputs.conf in there Edit it and enable one or more inputs to send data to Splunk There actually is an 'outputs.conf' but the Splunk Cloud TA/UF handles that to securely send to Splunk Cloud.   ... View more

Splunk only offers geoip via the command iplocation at search time. You could add the data using a 3rd part product before Splunk ingests it, but as far as Splunk doing that, the closest options you have (that I'm aware of) are: Custom Accelerated Data Model Modify Existing Accelerated Data Models to store those fields Create a lookup table - probably using KVSTORE due to high number of records It depends on your intended use cases for it. For the use cases you mentioned, it sounds like it would be used more for investigations in the original logs, in which case you'd have to tie it to time. For that purpose I would recommend using an Accelerated Data Model, though it wouldn't contain the raw logs. If you really need it in the raw logs, I would have either Logstash or CRIBL enrich the raw logs before ingest to Splunk or off to raw log storage depending on your needs.   ... View more

You will need a named capture group. If there is a space after the colon, or you're not sure, use this: message:\s*(?<raw_message>\S+) If there is always a space after the colon,  you could just use this below. The asterisk allow zero or more spaces (/s). You can learn more at regex101(dot)com or other sources. message: (?<raw_message>\S+) It's essential the same as the other person posted, but they were missing the ? for the named capture group and you don't really need anything before 'message' in this case.  ... View more

If using the FREE version at home, you will have to add the following line to your /etc/system/local/server.conf under the [general] tab (leave the other settings under [general] as well, but it should look like this, along with your other settings under there of course. For Splunk Enterprise, there is more information at the Docs link below. [general] allowRemoteLogin = always You can read about this and more information at this link, though I am submitting an edit to the page to correct typos and be more specific: https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/LaunchSplunkWeb ... View more

Use the second one I just listed for all destinations. If you want the status for each combination of src port and destination, you already had that in your image link. Note that your destinations were different which is why there were 2 states. The destinations are so similar perhaps you thought they were the same? ... View more

| stats latest(destination) as destination, latest(status) as status, by src port OR | stats values(destination) as destination, latest(status) as status by src port ... View more

Okay so you don’t want to split by destination then. Move destination to before the ‘by’ clause and use either latest(destination) or values(destination) if you want the whole list for that src and port. If you put destination after the BY clause, Splunk shows every unique combination of the fields after BY. ... View more

Dest is MPGDR vs MPGPR ... View more

I don’t see an issue in your image. The destinations are unique so that search shows the result of latest state per src dest combination. If that’s not what you wanted please list what you’d like to display instead. ... View more

I respectfully disagree. Though first(stats) is faster, it doesn’t guarantee the latest event chronologically, which is what the goal is here. First is faster because it doesn’t wait for the entire set of results, it will return the first event that streams in. Although that is often the most recent, it isn’t necessarily the most recent. ... View more

The only way that is possible is something else is wrong with either the data or your environment. Please post your entire SPL and a screenshot of results. As I mentioned, either the values aren’t actually unique or there are many events at once and an issue with duplicate events on your indexers. ... View more

The way to get the most recent status would be to end your query with: | stats latest(status) by src destination port If you wish to also see the time of the event in the results you would add it as a value rather than split the stats command by _time, to avoid seeing every entry for that src/dest/port combo, by adding this to the end of your query instead: | stats values(_time) as _time, latest(status) by src destination port If either of these result in more than one status, there is something else wrong with the values that are in src, destination, and/or port. The only ways you would see more than 1 status for these is if: 'status' field has multiple values per event (perhaps due to commands earlier in your search The values are unique between src, destination, port You can test if the 'status' field has multiple values using this command: | eval n = mvcount(status) | where n>1 | sort - n I would also note that 'destination' is not a CIM-compliant field, it should be normalized to just 'dest' using an alias or other method. Hope this helps! ... View more

It is likely that the indexes are not defined for the Nix App yet. Go through the configuration for the app and ensure you tell it which index(es) to find your Nix data in. https://docs.splunk.com/Documentation/UnixApp/5.2.5/User/First-timeconfiguration ... View more

Not quite the same, the caveat being that a SHC Deployer can overwrite /opt/splunk/etc/apps/ on the SHC members, but a Cluster Master will only control what is contained in /opt/splunk/etc/slave-apps/ on the Indexers. For Indexers, you would still need to manually clean up /opt/splunk/etc/apps/ regardless if they are a member of a cluster or not. ... View more

To push an empty bundle, use the '-force true' flag, syntax would be: splunk apply shcluster-bundle --answer-yes -force true -target : -auth : ... View more

@RickbondPNT just wondering if it worked or what other issues you might be having? Thanks! ... View more

Hi @RickbondPNT , if my answer helped, please accept it as the answer. Otherwise please provide more information and I'll be glad to help. Thanks!! ... View more

May need some more information, you mentioned "get permissions", so you may be referring to Event ID 4672, which is not always logged with each logon (4624). The events you are describing should be separate EventCodes aka EventIDs, the values of which should be in the "signature_id" field in the data model. Assuming you have the Windows TA installed on your indexer and search head, try the search below (change index to match your Windows events) to see order of events in a more readable format. Notice the relationship between 4672 (Special privileges assigned to new logon) versus 4624 (An account was successfully logged on) Not all events 4624 events will be preceded by 4672. index=* (sourcetype=WinEventLog* OR sourcetype=XmlWinEventLog*) | lookup windows_signatures.csv signature_id as EventCode OUTPUT signature as description | table _time user EventCode action description If your Authentication data model is accelerated, you can run this search to view the events with Event ID. | tstats summariesonly=t count from datamodel=Authentication by _time span=1m Authentication.user Authentication.signature_id Authentication.action sourcetype Just remove the 'summariesonly=t' if you have not accelerated that data model. ... View more