I guess we are not the only ones using Forwarding of WinEvents to a central server with an indexer. Does anyone else do it and use the windows infrstructure app? We forward events and thus source and sourcetype is WinEventLog:ForwardedEvents I guess we should override source and sourcetype based on the value in LogName. Has anyone done this and could you provide the necessary transforms? (could it be included in the app or a small TA companion for it?) ... View more

I copied some stuff like .css and .js from a demo app with custom visualizations and included these files to a self made app with custom views. Now I get a extra div in my dashboard/forms called sourcecode-viewer which is not referenced in the simple xml of the dashboard. Even if I remove the css etc from the app and recreate the simple xml dashboard and restart splunk, I still get the div in all forms/dashboards in this app. Where exactly do I have to remove stuff to get it out again? ... View more

I do consume a filter and specify a few fields but i only get one event with error="". Doing the same search from command line takes a while but works... ... View more

I have a numeric value representing flags. It is the value in userAccountControl defined as follows: typedef enum { ADS_UF_SCRIPT = 1,        // 0x1 ADS_UF_ACCOUNTDISABLE = 2,        // 0x2 ADS_UF_HOMEDIR_REQUIRED = 8,        // 0x8 ADS_UF_LOCKOUT = 16,       // 0x10 ADS_UF_PASSWD_NOTREQD = 32,       // 0x20 ADS_UF_PASSWD_CANT_CHANGE = 64,       // 0x40 ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 128,      // 0x80 ADS_UF_TEMP_DUPLICATE_ACCOUNT = 256,      // 0x100 ADS_UF_NORMAL_ACCOUNT = 512,      // 0x200 ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 2048,     // 0x800 ADS_UF_WORKSTATION_TRUST_ACCOUNT = 4096,     // 0x1000 ADS_UF_SERVER_TRUST_ACCOUNT = 8192,     // 0x2000 ADS_UF_DONT_EXPIRE_PASSWD = 65536,    // 0x10000 ADS_UF_MNS_LOGON_ACCOUNT = 131072,   // 0x20000 ADS_UF_SMARTCARD_REQUIRED = 262144,   // 0x40000 ADS_UF_TRUSTED_FOR_DELEGATION = 524288,   // 0x80000 ADS_UF_NOT_DELEGATED = 1048576,  // 0x100000 ADS_UF_USE_DES_KEY_ONLY = 2097152,  // 0x200000 ADS_UF_DONT_REQUIRE_PREAUTH = 4194304,  // 0x400000 ADS_UF_PASSWORD_EXPIRED = 8388608,  // 0x800000 ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION  = 16777216 // 0x1000000 } ADS_USER_FLAG_ENUM; So i seek to know if the user is locked but i would be interested in a more generic approach. Perhaps a lookup and a custom command? search language is prefered though. ... View more