Hi All... Splunk newbie learning videos, for absolute beginners: https://www.youtube.com/@SiemNewbies101/playlists I have added 24 small videos of rex... Completely for Splunk newbies and beginners. hope this helps somebody, thanks.

wow, definitely a case of "your mileage may differ"... this is just a small sample of these alerts here, and on the ones triggered by Splunk, they still seem to function OK: ADPClientService.exe, version: 4.1.38.0, time stamp: 0x62c69205 AUEPMaster.exe, version: 1910.24.6.725, time stamp: 0x5d39726f AdAutoUpdateSDK.dll, version: 0.0.0.0, time stamp: 0x61dc3463 AdskAccessServiceHost.exe, version: 1.27.0.4, time stamp: 0x61dc35ae AdskUpdateCheck.exe, version: 1.27.0.4, time stamp: 0x61dc3558 CcmProfiler.dll_unloaded, version: 5.0.9106.1000, time stamp: 0x642d9f3d FMEngine.dll, version: 19.2.2.234, time stamp: 0x60451558 KERNEL32.DLL, version: 10.0.17763.4720, time stamp: 0xa2ec4df3 KERNELBASE.dll, version: 10.0.19041.3393, time stamp: 0x6b4de7c9 OUTLOOK.EXE, version: 16.0.10402.20023, time stamp: 0x64ef06a7 smartscreenps.dll, version: 10.0.19041.3031, time stamp: 0x92650ce8 PDFMEngine.dll, version: 23.6.20320.0, time stamp: 0x64f8d26b RPCRT4.dll, version: 10.0.17763.4644, time stamp: 0x565f63ab RtkAudUService64.exe, version: 1.0.0.176, time stamp: 0x5c6f93ad VCRUNTIME140.dll, version: 14.16.27033.0, time stamp: 0x5d30eadf biwinrt.dll, version: 10.0.17763.2989, time stamp: 0x790cc0bc splunk-winevtlog.exe, version: 2304.1280.25713.15594, time stamp: 0x64713ec1

Depending on your data (which it would have been useful for you to share), you might be able to count the occurrences of each entitlement for each role for last Saturday and the previous Saturday, and where the count in not 2, there has been a change.

You need to define the format or at least how to find and extract the fields you want from the events in the logs. Just giving the file extension does not define the format. Assumptions can sometimes be made about .csv file formats, for example, but lesser-known formats, not so much.

thank u for ur response my friend its usefull but i know only the big pack its avaible for solaris thats what i need and thats what im using on a red hat and now i want to install on a Solaris 11.4 if u lknow how i can make via Terminal on solaris for install and download i will apreciated

Oh! If the issue is tied toWinEventLog://ForwardedEvents maybe you'd like to also comment on splunk-winevtlog.exe keeps crashing post. I also stumbled of this input stanza on my investigation, but on our estate, we're not enabling it.

Hi @DANITO115 ...on Solaris only Universal Forwarder can be installed and logs can "collected" from the Solaris.  Indexer / Search Head, HF, LM, DS, etc can not be installed.    image is from https://docs.splunk.com/Documentation/Splunk/9.1.1/Installation/Systemrequirements   As you are a new member, Karma / upvotes are appreciated by everyone. if this post solves your issue, pls accept it as solution, so question will move to answered queue. thanks. 

Sorry but this is not my case. I have no other application faulting in my application event viewer, only splunk-winevtlog.exe is crashing. Moreover if I disable the [WinEventLog://ForwardedEvents] input it stops crashing, meaning that there is something related to it (maybe the amount of events, maybe the renderXml phase, I don't know). We first set ForwardedEvents size to 8 GB in EventViewer, I believed this was the issue so I tried with 256 MB but it still crashes. I also tried to remove any whitelist/blacklist instruction from inputs (I read there is a know issue about that) with no luck. When the process crashes I got this on splunkd.log: 10-06-2023 11:42:39.214 +0200 WARN TcpOutputProc [6564 indexerPipe] - Pipeline data does not have indexKey. [_path] = C:\Program Files\Splunk\bin\splunk-winevtlog.exe\n[_raw] = \n[_meta] = punct::\n[_stmid] = tMwn7kh87nMs0iK\n[MetaData:Source] = source::WinEventLog\n[MetaData:Host] = host::PRD-LOGCOLL-SRV\n[MetaData:Sourcetype] = sourcetype::WinEventLog\n[_done] = _done\n[_linebreaker] = _linebreaker\n[_conf] = source::WinEventLog|host::PRD-LOGCOLL-SRV|WinEventLog|\n I would be more than glad to confirm that it's a "non issue" but in my case events are not collected or seem to be collected partially with huge delays. Regards Alessandro