Splunk event display incomplete

gendupali · ‎10-11-2020

I am using Splunk app for LOGbinder to display AD Changes in Splunk. All events are getting collected in the Event viewer correctly. But when I search index=main in Splunk, I see "Message=Microsoft Windows security auditing" to all events. Can you help me with this please?

inventsekar · ‎10-11-2020

Not sure of this Splunk app for LogBinder, .. but, maybe, you can check this post:

https://community.splunk.com/t5/Splunk-Enterprise/No-results-found-in-the-ADChanges/m-p/512380

installation steps(maybe, you can cross verify your installation steps)

https://support.logbinder.com/SuperchargerKB/50135/8-Install-Supercharger-with-Splunk-Light-and-the-...

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

Splunk event display incomplete

configuration

using Splunk Enterprise

Aligning Observability Costs with Business Value: Practical Strategies

Mastering Data Pipelines: Unlocking Value with Splunk

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Are you a member of the Splunk Community?

Splunk event display incomplete

configuration

using Splunk Enterprise

Aligning Observability Costs with Business Value: Practical Strategies

Mastering Data Pipelines: Unlocking Value with Splunk

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0