Whenever I enable index clustering on what is to be my splunk manager, I go to restart it and it never comes back on.  Disabling index clustering through the cli returns access to the gui and allows splunk to start like normal.  Journalctl returns the following (after trying to start splunk with "systemctl start splunk")... > splunk[9423]: Waiting for web server at https://127.0.0.1:8000 to be available......... > splunk[9423]: WARNING: web interface does not seem to be available! > systemd[1]: splunk.service: control process exited, code=exited status=1 > systemd[1]: Failed to start Splunk Enterprise   Trying to start splunk from the binary returns the following... > Checking http port [8000]: not available > ERROR: http port [8000] - no permision to use address/port combination.  Splunk needs to use this port.   I've reinstalled splunk and rebuilt the VM that splunk is sitting on and neither of these have worked.

Hello all,  I could use some help here with creating a search. Ultimately I would like to know if a user is added to a specific set of security groups what security groups if any were removed from that same user.  Here is a search for security group removal: index=wineventlog EventCode=4729 EventCodeDescription="A member was removed from a security-enabled global group" Subject_Account_Name=srv_HiveProvSentryNe OR Subject_Account_Name=srv_HiveProvSentry source="WinEventLog:Security" sourcetype=WinEventLog | table member, Group_Name, Subject_Account_Name, _time Here is a search for security group added: index=wineventlog EventCode=4728 EventCodeDescription="A member was Added to a security-enabled global group" Subject_Account_Name=srv_HiveProvSentryNe OR Subject_Account_Name=srv_HiveProvSentry source="WinEventLog:Security" sourcetype=WinEventLog | table member, Group_Name, Subject_Account_Name, _time additional search info: EventCode=4728 Added EventCode=4729 Removed Group_Name - security group Subject_Account_Name - prov sentry member - user security groups, I would like to monitor users being added to: RDSUSers_GRSQCP01 RDSUSers_GROQCP01 RDSUSers_BRSQCP01 RDSUSers_BROQCP01 RDSUSers_VRSQCP01 RDSUSers_VROQCP01 Again I am looking to monitor if a user was added to any of the above 6 security groups were they within a few hours before and ahead of the event removed from any other groups. let me know if I can provide any additional info and as always thank you for the help.

My data is coming for 0365 as JSON, I am using SPath to get the required fields after that i want to compare the data with a static list containig roles to be monitored but unforutnaly I am getting the below error Error in 'table' command: Invalid argument: 'role="Authentication Administrator"'   Its not working. PFA the releveant snap