Me and another engineer were taking a look at `index=corelight sourcetype=corelight_notice signature="Scan::*"`. We noticed that `src` was not properly parsed given `kv_mode=auto`. We've attempted the follwing four course of action: 1. performed an EXTRACT on _raw as : "src":"(?<src>[^"]+)", 2. performed a REPORT as: corelight_notice_src * with a transform as `"src":"(?<src>[^"]+)",` on _raq 3. perform an EXTRACT on _raw as : \"src\":\"(?<src>[^\"]+)\", 4. * performed a REPORT as: corelight_notice_src * with a transform as `* \"src\":\"(?<src>[^\"]+)\",` Note that performing the `| rex field=_raw "\"src\":\"(?<src>[^\"]+)\","` at search time works fine. We also attempted with `AUTO_KV_JSON = false` with the above tests 3 and 4, which failed. We also attempted with `AUTO_KV_JSON = false` and `KV_MODE = none` with the above tests 3 and 4, which failed Note that the following works: ``` index=corelight sourcetype=corelight_notice signature="Scan::*" | spath output=src path=src ``` When AUTO_KV_JSON=true, then most JSON fields are extracted (except for src). When AUTO_KV_JSON=true and KV_MODE=json, then most JSON fields are extracted (except for src).   Any ideas on what the problem is?   ``` {"_path":"notice","_system_name":"zEEK01","_write_ts":"2021-11-12T23:22:24.722517Z","ts":"2021-11-12T23:22:24.722517Z","note":"Scan::Address_Scan","msg":"kk: 192.168.0.1 scanned at least 27 unique hosts on ports 443/tcp, 80/tcp in 42m29s","sub":"local","src":"192.168.0.1","peer_descr":"proxy-01","actions":["Notice::ACTION_LOG"],"suppress_for":1,"severity.level":3,"severity.name":"error"} ``` Thanks, Matt ... View more

Hello, I’m working on a powershell inputs and am stuck in regards to extracting the timestamp. An event is stdout from my script as follows: 2020-02-05T14:11:36.000000-05:00 actinguser_userid="WJ" affecteduser_userid="DG" affecteduser_name="G,D" actiondescription="Password reset by administrator. " I am using the following props: [this:adminevents] SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false #KV_MODE = auto TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N #TIME_PREFIX = Timestamp\s*:\s TZ = -05:00 Is it possible to extract the timezone directly by parsing the timestamp? This is my first run through of an extraction, so I apologize if it's simple. Also, how do I debug extraction? Is there a way to enable debugging so that a specific sourcetype's extraction steps are logged to _internal ? Thanks, Matt ... View more

I'm building a dashboard where a user selects a dropdown item that has the value of a search macro name and then a single value panel is rendered as a stats dc(X) (where X is a named field found in both macros). However, I'm running into a strange occurrence where if I select a macro to set diff against itself, the value isn't 0 , | set diff [ `ad_enabled_computer_objects_no_vdi_all` | fields asset_hostname] [ `ad_enabled_computer_objects_no_vdi_all` | fields asset_hostname] This occurs on many macros that return results from many different data sources. Has anyone experienced this with set diff ? Thanks ... View more

Hello, I have an inputs.conf monitor stanza configured to ingest syslog data that has been written to a file with rsyslog . However, I misconfigured the monitor stanza to send data to a non-existant index. It appears that this data has not been ingested into any other index at this time (there was no indexes.conf lastChanceIndex set at that time). I now would like to reingest all data non-destructively to the proper index. How can I do configure a monitor stanza to reingest previously ingested data? Do I set the initCrcLength to 0 ? Thanks, Matt ... View more

Hello, I'm attempting to verify a blacklist parameter for a wineventlog stanza by using regex and rex in search and the escape character backslash ( \ ) is being treated incorrectly by both regex and rex . For instance, I know that splunk search uses PCRE for regex. If the message field contents are as follows A network share object was checked to see whether client can be granted desired access. Subject: Security ID: S-1-5-21-001 Account Name: testuser Account Domain: CONTOSO Logon ID: 0xA04CAB48 Network Information: Object Type: File Source Address: 192.168.0.1 Source Port: 62387 Share Information: Share Name: \\*\uemprofiles Share Path: \??\D:\UEM\uemprofiles Relative Target Name: testuser\favorites\thisisawebpage.url Access Request Information: Access Mask: 0x2 Accesses: WriteData (or AddFile) Access Check Results: WriteData (or AddFile): Granted by D:(A;;0x1301bf;;;WD) Given the documentation on backslash escape chars (hxxps://docs.splunk.com/Documentation/Splunk/7.3.1/Search/SPLandregularexpressions), I believe all backslashes in a path ( \ ) must be stated within a regex as four backslashes ( \\\\ ). Therefore, I expect to get match the above event with | regex Message="Share Path:\s*\\\\\?\?\\\\D" | rex "Share Path:\s*\\\\\?\?\\\\(?P<path>.*)" where path is then equal to D:\UEM\uemprofiles , and the rex works. But given that regex how do i know for sure that this acts the same way as rex , and thusly how do I know that blacklist in inputs.conf will act this same way/ In fact, I have a feeling that blacklist does not require the additional backslash escape conditions. Is this correct? Therefore, to blacklist these events (only when share path contains \??\D: ) within an inputs.conf WinEventLog stanza, the following syntax should be used for a successful regex match: blacklist3 = EventCode="5145" Message="Share Path:\s*(\\\?\?\\D:)" Is this correct? Thanks, matt ... View more

Hello, I found two cases where the ES correlated search "Brute Force Access Behavior Detected" is "invalid" for our purposes. They are both indicators that an AD account is locked out or disabled and are as follows: Event Code = 4768 AND krb tgt request result code = 0x12 or 0x6 Now, I'm having some trouble with syntax for this (note that the datamodel expanded while I was working, and the changes I've made are reflected below the search: (index=* OR index=_*) ((()) tag=authentication NOT (action=success user=*$)) DIRECTIVES(READ_SUMMARY(datamodel="Authentication.Authentication" summariesonly="false" allow_old_summaries="false")) | eval action=if(isnull(action) OR action="","unknown",action), app=if(isnull(app) OR app="",sourcetype,app), src=if(isnull(src) OR src="","unknown",src), src_user=if(isnull(src_user) OR src_user="","unknown",src_user), dest=if(isnull(dest) OR dest="","unknown",dest), user=if(isnull(user) OR user="","unknown",user) | search action=failure | eval is_Failed_Authentication=if(searchmatch("(action=\"failure\")"),1,0), is_not_Failed_Authentication=1-is_Failed_Authentication, is_Successful_Authentication=if(searchmatch("(action=\"success\")"),1,0), is_not_Successful_Authentication=1-is_Successful_Authentication, is_Default_Authentication=if(searchmatch("(tag=\"default\")"),1,0), is_not_Default_Authentication=1-is_Default_Authentication, is_Insecure_Authentication=if(searchmatch("(tag=\"insecure\" OR tag=\"cleartext\")"),1,0), is_not_Insecure_Authentication=1-is_Insecure_Authentication, is_Privileged_Authentication=if(searchmatch("(tag=\"privileged\")"),1,0), is_not_Privileged_Authentication=1-is_Privileged_Authentication | fields "_time" "host" "source" "sourcetype" "dest_bunit" "dest_category" "dest_nt_domain" "dest_priority" "duration" "response_time" "signature" "signature_id" "src_bunit" "src_category" "src_nt_domain" "src_priority" "src_user_bunit" "src_user_category" "src_user_priority" "tag" "user_bunit" "user_category" "user_priority" "action" "app" "src" "src_user" "dest" "user" "is_Failed_Authentication" "is_not_Failed_Authentication" "is_Successful_Authentication" "is_not_Successful_Authentication" "is_Default_Authentication" "is_not_Default_Authentication" "is_Insecure_Authentication" "is_not_Insecure_Authentication" "is_Privileged_Authentication" "is_not_Privileged_Authentication" | search signature_id!=4768 | rex "Result Code:\s*(?<krb_tgt_request_result_code>.*)" | search krb_tgt_request_result_code!=0x12 krb_tgt_request_result_code!=0x6 | eval DoW_Hour_Min = strftime(_time,"%A_%H_%M") | stats count by DoW_Hour_Min, app, src, dest, action, user, signature_id, krb_tgt_request_result_code | sort -count changes are: | search action=failure | search signature_id!=4768 | rex "Result Code:\s*(?.*)" | search krb_tgt_request_result_code!=0x12 krb_tgt_request_result_code!=0x6 | eval DoW_Hour_Min = strftime(time,"%A%H_%M") | stats count by DoW_Hour_Min, app, src, dest, action, user, signature_id, krb_tgt_request_result_code | sort -count So, my problem is... the rex is only valid for events with signature_id=4768. But I want to exclude explicitly those events. I guess the question is two fold: 1) do I care about the efficiency of the rex, insomuch that I only want it to exercise against signature_id=4768? How do I do that? 2) I really only care about dealing with signature_id=4768 with krb_Tgt_request_result_code is: 0x12 or 0x6. How do I do that? Will it work if I do a single rex with two named capture groups, and then I can run a subsequent search for my inverse cases? Thanks, Matt ... View more