All Apps and Add-ons

Windows Access And Changes not Working

bowmanja
New Member

It appears that the Windows Access And Changes not Working properly. It continuously says populating at the bottom of the dashboard. Does anyone have recommendations to fix this?

0 Karma

igifrin_splunk
Splunk Employee
Splunk Employee

Does the panel named Host Authentications Map say Populating... under the Source Hosts and Destination Hosts multi-select fields?

If that's the case, the search populating the list of hosts is running too long for some reason - try running that search on its own over a 7-day period:

| tstats prestats=true summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.app=win* by Authentication.src 
| stats count by Authentication.src

It's the search that populates the multi-select fields. It expects Authentication data model to be accelerated.

The next InfoSec app update will include some minor changes to this dashboard panel but please share additional details like the Splunk version, whether the search above produces a list of machines/IPs and whether the rest of the reports on the dashboard show data. This way it will be easier to pinpoint what happens in your setup and potentially prevent this happening in the next app update.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...