Alerting

EventCode 4738 for real time alert problems with Delays.

jkeellogic
Explorer

I have a real time alert set for admin accounts whenever they make a change and create Event code 4738. All client UF are running win 2012r2 . Spunk support was with me one day and we fine delays in index time. some client work within minutes while other take hours later or the next day. Another issue related is listing all Domain Controller and some are missing with the command below.
index=winevents source="WinEventLog:Security" | rare limit=50 host
All Domain Controller should come up as they are all the same hardware, OS, patch level & same UF installed.
Upgrading the UF from 6.2.3 to 6.2.7 did not help.
Also upgrade my Heavy Forwarder to 6.2.7 did not help.
I have no load issues with my index cluster and all system log from the DC index, but 4738 Security logs don't.
How can I fix this? or bet way to debug between UF to HF to Indexers?

0 Karma

DalJeanis
Legend

First, try this...

  earliest=-1h@h latest=+2y  index=winevents source="WinEventLog:Security" 
| stats max(time) as maxtime count by host 
| rename maxtime as _time

Check if any events are future-dated, and check to make sure that every host is present.

I would not use rare in this situation, since it limits the number of results.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...