Hey, I haven't used DUO with Splunk yet, but have used DUO as additional protection for SSH logins. There, you could exclude certain user accounts, or source IPs from having to use the DUO two-factor. It was simply available in the DUO admin interface on their website - look for something like bypass. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

So... you're talking about a TA/app you downloaded? Or something you built yourself? There's a bunch of information missing... ... View more

Yeah, the different " , “ are the devil's work and should be avoided (looking at you, MS Word!). We should however do those UTF-8 things more often, test where Splunk breaks and then get it fixed, because, standards! ;D ... View more

As @FrankVI also said, your problem is most likely based on broken timestamp recognition. Do you read that file locally, or is it send to you via syslog? ... View more

Is this the complete error message? ... View more

Hey, when thawing (restoring) frozen data, you're limited to the name of the index, and the time range of the bucket(s) of that index you want to restore. You can find details on how to do this in the "Restore archived indexed data" doc. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

I'd argument that, as UTF-8 is de-facto a web standard, using such characters is perfectly fine and much less complex and error prone than doing any of that with JS/CSS extensions. It's a nice hack, have to remember that. 🙂 ... View more

Most likely reason - the index you entered hasn't been created before. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Well - you could try to use the Splunk Machine Learning Toolkit, but explaining it in detail is a little beyond the scope of a single answer here. Start with the toolkit - it has a Youtube playlist and a algorithm cheat sheet in its description, so that's a good point to get started. However, machine learning is a little more sophisticated, so your results may vary 😉 Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Your question is lacking a lot of details, but a possible approach could go like this: Create a new index Setup your input to send it's data to that index Wait some time In the Indexes settings page, check if there are any events in that index. If yes - you can just search that new index. If not, something has gone wrong with the input itself. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Hey, you could use [tcp-ssl://1234] in inputs.conf - it offers encrypted receiving of data. However, best practice is to run a dedicated syslog server, which receives the data and writes it to disk, and have Splunk monitor those files. This helps with reliability, as a syslog server restart might take less than one second, but restarting Splunk might take up to several minutes. You might loose data that would come in during such an restart - which also happens more often with Splunk instances than with syslog servers. I'd therefore recommend to setup syslog-ng, with encryption enabled, and send your data there. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

No, it's perfectly fine. Just to make sure: If you download somebody else's app, you should never change the default configs, because you'll loose those changes on an update - but it's perfectly fine to add stuff to local . Actually, it's good practice for app developers to not ship any active inputs with an app, because an app shouldn't start inputs, create indexes or other stuff - that should be part of the install guide and a conscious action by the admin who installs it. So - create an inputs.conf in the local directory of the app, and then deploy it. 🙂 ... View more

Hey, you can just restore the file from your backup. 😉 Seriously, backing up or putting your stuff into version control can save you a lot of headaches in the future... ... View more

Do you have any other indexes that are being filled by DBConnect? The error messages you posted do not look like any kind of index problem, but they point to errors in your DB Connect input. I guess this is a Windows installation? ... View more

Did you change the type of the lookup to a wildcard lookup? ... View more

Is that index being filled using DB Connect? ... View more

Mhh, I'd try a splunk btool props list or splunk show config props to see if the config is actually applied, or if anything is applied after those transforms that might reset the _TCP_ROUTING variable... ... View more

Sure you can. If you select it during install, it should be put into etc/system/local/inputs.conf ... View more

You can find more about this in this doc. It's basically one input stanza per Windows log category, like this: [WinEventLog://Security] See the doc for more details. ... View more

I guess that your regex looks for unisystems.gr , but the events contain example.com is due to anonymization, right? ... View more

Your inputs.conf stanza just needs an entry like this: renderXml = True You can also add other WinEventLog lines for application, system, security, etc. - did you remove them from your inputs.conf? ... View more