I am trying to map a users activity once they've logged into a vdi session to when they log into a specific application. My search is as follows: I have tried using the return, fields + and join commands to make this work. Each search returns values individually but together I get nothing. Thoughts? Searches: Index=* user=xxx* computer=vdi* [search sourcetype=something user=user1 event=*"logged"* | fields + user, event] | eval hostname=coalesce(computer, host) | table _time, user, hostname, event |sort 0 -_time OR Index=* user=xxx* computer=vdi* [search sourcetype=something user=user1 event=*"logged"* | return 100 user, event] | eval hostname=coalesce(computer, host) | table _time, user, hostname, event |sort 0 -_time OR Index=* user=xxx* computer=vdi*| join user max=0 [search sourcetype=something user=user1 event=*"logged"* | fields + user, event] | eval hostname=coalesce(computer, host) | table _time, user, hostname, event |sort 0 -_time updated to mark code ... View more

Hi, I'd like to install the Tripwire Enterprise app on one of my Search Heads. I do not want the logs to be stored locally since it is a search head. The logs should be pushed to my indexers, preferably load balanced. So my question is this, given that the app will be installed on a search head, would it be best to install a universal forwarder on the tripwire console server, then configure the outputs.conf files to send to my indexers? Given the question i've just asked, can I also configure the Tripwire Data Directory to point to the essentially load balanced indexers when I setup the app? Or is there a better way to accomplish all of this? The installation instruction does not mention any of this. ... View more

So I have two LDAP strategies setup for contractors. The strategies pulled the information in from AD and I have mapped each strategy to a Role. Now when I go to the Users tab, none of those users who are contractors show up. Regular users (employees) show up without issue but contractors who sit in a different OU within AD than employees do not. Any thoughts? Note, I have checked splunkd.log and set the necessary logging profile to debug to no avail. ... View more

I have the following configuration: 1 Master Node, 1 Search Head, 2 Peers running version 6.1.1. RF 2, SF 1. When I update the indexes.conf within */master_apps/_cluster on the master node and then attempt to Distribute the Configuration Bundle to the peers, the master node disconnects and acts as though it is restarting. Any thoughts? Within the splunkd.log it shows the following: Note, I have rebooted the master node and ensured the peers were all online, the distribution bundle does not take. Splunkd daemon is not responding: ('Error connecting to /services/cluster/master/control/default/apply: The read operation timed out',) Splunkd logs 07-10-2014 13:00:27.296 -0400 WARN CMMaster - event=removePeerBuckets peer=38E77442-7569-4EA1-A90F-0C76B0AF4D8F bid=main~5~043DCACA-C500-485A-9C52-84D2F2DE6C2D msg="Bucket is not on any other peer! Removing it." 07-10-2014 13:00:27.296 -0400 WARN CMMaster - event=removePeerBuckets peer=38E77442-7569-4EA1-A90F-0C76B0AF4D8F bid=main~5~38E77442-7569-4EA1-A90F-0C76B0AF4D8F msg="Bucket is not on any other peer! Removing it." 07-10-2014 13:00:27.296 -0400 WARN CMMaster - event=removePeerBuckets peer=38E77442-7569-4EA1-A90F-0C76B0AF4D8F bid=main~6~043DCACA-C500-485A-9C52-84D2F2DE6C2D msg="Bucket is not on any other peer! Removing it." 07-10-2014 13:00:27.296 -0400 WARN CMMaster - event=removePeerBuckets peer=38E77442-7569-4EA1-A90F-0C76B0AF4D8F bid=main~6~38E77442-7569-4EA1-A90F-0C76B0AF4D8F msg="Bucket is not on any other peer! Removing it." 07-10-2014 13:00:27.296 -0400 WARN CMMaster - event=removePeerBuckets peer=38E77442-7569-4EA1-A90F-0C76B0AF4D8F bid=main~7~043DCACA-C500-485A-9C52-84D2F2DE6C2D msg="Bucket is not on any other peer! Removing it." 07-10-2014 13:00:27.296 -0400 WARN CMMaster - event=removePeerBuckets peer=38E77442-7569-4EA1-A90F-0C76B0AF4D8F bid=main~7~38E77442-7569-4EA1-A90F-0C76B0AF4D8F msg="Bucket is not on any other peer! Removing it." 07-10-2014 13:00:27.296 -0400 WARN CMMaster - event=removePeerBuckets peer=38E77442-7569-4EA1-A90F-0C76B0AF4D8F bid=main~8~38E77442-7569-4EA1-A90F-0C76B0AF4D8F msg="Bucket is not on any other peer! Removing it." 07-10-2014 13:00:27.296 -0400 WARN CMMaster - Apply bundle - all peers are down. Will not switch bundles. ... View more

The forwarder and app has been installed and configured as shown in the instructions. The apps configuration settings cannot detect all the logs currently coming into Splunk. It detects some of the data inputs but not all. Is there a specific location I need to check to update this? Or am I missing some configuration step? The forwarder is monitoring the relevant location where all the logs sit. ... View more