Splunk Search

Being new to Splunk, do my inputs.conf and outputs.conf look correct on my local PC?

rsingh
Explorer

deploymentclient.conf

[target-broker:deploymentServer]
targetUri = splunk.domain.com:8089

outputs.conf

[tcpout]

server = splunk.domain.com:8089

[tcpout-server://splunk.domain.com:8089]

inputs.conf

[default]
host = MYPC257

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[WinEventLog://Security]
index=security
current_only=1
evt_resolve_ad_obj=0
renderXml=1
disabled=0

Logon Failures

index=windows 
LogName=Security EventCode=4625 | table _time, Workstation_Name, Source_Network_Address,
host, Account_Name

Monitor for Administrative and Guest Logon Failures

index=windows 
LogName=Security 
EventCode=4625 (Account_Name=_administrator OR Account_Name=guest) | stats
count values(Workstation_Name) AS Workstation_Name, 
Values(Source_Network_Address) 
AS Source_IP_Address,values(host) AS Host by Account_Name | where count > 3
0 Karma
1 Solution

lguinn2
Legend

deploymentclient.conf: if splunk.domain.com is running the deployment server, then splunk.domain.com:8089 is probably correct. 8089 is the default management port.

However, port 8089 is probably wrong for outputs.conf. You need to find out the receiving port that is configured on splunk.domain.com. Often, 9997 is used, but there is no default. You need to replace the 8089 with the proper port number everywhere in this file.

I have no idea if the inputs.conf or the searches are correct.

View solution in original post

0 Karma

lguinn2
Legend

deploymentclient.conf: if splunk.domain.com is running the deployment server, then splunk.domain.com:8089 is probably correct. 8089 is the default management port.

However, port 8089 is probably wrong for outputs.conf. You need to find out the receiving port that is configured on splunk.domain.com. Often, 9997 is used, but there is no default. You need to replace the 8089 with the proper port number everywhere in this file.

I have no idea if the inputs.conf or the searches are correct.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...