I am trying to configure the distributed monitoring console without the UI (for automation purposes). It seems that I have gotten most things right - all instances show up the way I want them to, however they are all marked as "unreachable". It seems that I must do the step where I provide credentials for the mc host to login to the monitored host. However I cannot figure out what this step actually does. Also I cannot find anything that hints to the credentials being stored anywhere. So what does this login process actually do, and how can I mimic that bevhaviour for the mc from the commandline/ via config files? Any insight on how the setup process works behind the scene would be appreciated.

I have an application that I am trying to monitor.  There is a specific event code for when the tool is opened to modify the tool (EventCode=250).  There is an EventCode for when it is closed (EventCode=100).  These two codes display a user name, but the events between them do not.  How can I write a search to look for these two events then display the changes between them with the username who completed the change?   | from datamodel:P3 | search EventCode=250 OR 100 OR 70 OR 80 | eval user = coalesce(User, Active_User) | eval Event_Time=strftime(_time,"%m/%d/%y %I:%M:%S %P") | table Event_Time, host,user,Device_Added,Device_SN,Device_ID,EventCode, EventDescription Event_Time                        host              user      Device_Added      Device_SN       Device_ID      EventCode  02/22/24 08:49:44 am Test-Com   xxxxx                                                                                                 100 02/21/24 03:59:12 pm Test-Com   xxxxx                                                                                                  250 02/21/24 03:56:08 pm Test-Com   xxxxx                                                                                                  100 02/21/24 03:56:00 pm Test-Com                            USB 1                   12345          PID_1                   70  02/21/24 03:56:00 pm Test-Com                            USB 2                    6789            PID_2                   70  02/21/24 03:51:10 pm Test-Com                            USB 1                   12345          PID_1                   80   02/21/24 03:50:44 pm Test-Com     xxxxx                                                                                                  250

Hi, I am looking to grab all windows events of successful NTLM logins without using Kerberos. Here is my query so far.     "eventcode=4776" "Error Code: 0x0" ntlm   I think this is working as of now, however it brings results including the value of Kerberos, I tried using the value, Not "Kerberos" , however it completely broke my search result.   I am looking to grab only the value of "Account Name:" and "Source Network Address:" then export it to a csv file every week.    Is this something I can do with Splunk? If so any help would be appreciated. Thanks.