My research and testing suggests that this feature cannot be turned off. Fortunately it appears only a limited number of events have this verbose text added to them, at least at this time. 13 events in total: 4612: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. 4616: The system time was changed. 4618: A monitored security event pattern has occurred 4624: An account was successfully logged on 4625: An account failed to log on 4634: An account was logged off 4647: User initiated logoff 4648: A logon was attempted using explicit credentials 4769: A Kerberos service ticket was requested 4778: A session was reconnected to a Window Station 4779: A session was disconnected from a Window Station 4780: The ACL was set on accounts which are members of administrators groups 4908: Special Groups Logon table modified Out of these, only 4624, 4625, 4634, 4647, 4648, 4769 and possibly 4778 and 4779 are common enough to worry about stripping the description text. Based on this limited number of event IDs it might be best to just use transforms or sedcmd... ... View more

Hmm, doing some testing and this definitely did not help. ... View more

admin by default can search all internal indexes. You can check what indexes a role can search by going to Manager > Access Controls > Roles > Role_Name > Indexes. ... View more

Splunk now has a command for ip lookups built in -- iplocation. This might be easier to use than the GeoIP app. ... View more

Hmm, not 100% sure how to debug this as I never ran into problems like this, but you can take a look at your scheduled searches and their actions in the _internal index. index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" savedsearch_name="Your search name" Should give you some data on what alert_actions were taken for your saved search. Also interesting would be took at the status value -- maybe there are some failures? Might be a good starting point. ... View more

Katey, solution 3 you posted sounds best. Basically you would want to set up syslog-ng on your splunk server and index the log files it generates. Point your managed hosts to send syslog to the syslog-ng instance on your splunk server and you're done. I recommend configuring syslog-ng to create a log file per host, preferably in a directory structure that identifies the host: /var/log/syslog-ng/hostA/logfile.log /var/log/syslog-ng/hostB/logfile.log /var/log/syslog-ng/hostC/logfile.log And then when configuring your monitor, set the host to be dynamically defined based on a segment in the path (in this case segment 4). Check out http://www.splunk.com/base/Documentation/latest/Admin/Setadefaulthostforaninput#Dynamically_setting_the_default_host_value_for_a_file_or_directory_input for more info. Hope this will get you down the right track. ... View more

Consider adding some pretty formatting to the search string 🙂 ... View more

Take a look at the following: http://answers.splunk.com/questions/2602/can-splunk-filter-match-events-and-bring-back-neighbouring-events-like-gnu-grep/4466#4466 The accepted answer shows how to go forward/back a number of events. ... View more

Duplicate question ... View more

Came across this today: http://technet.microsoft.com/en-us/library/ee126097(WS.10).aspx#BKMK_Controlling Event Viewer and Resulting Internet Communication in Windows 7 and Windows Server 2008 R2 - Procedures for preventing the flow of information to and from the Internet through Event Viewer Sounds like an interesting lead. ... View more

Can you elaborate a bit please? Are they splunk users and you want to look at splunk's audit logs or are they users in a different system? If they are a different system, what system, how do you get the logs, can you provide sample data? You'll get a better answer the more detail you provide. ... View more

Hmm, I don't think you can turn case sensitivity on in the general search, but you should be able to hack it with rex: foo | rex "(?<uppercase>FOO)" | search uppercase=* ... View more

Btw, your subject line indicates >3 but your question indicates >=3... ... View more

Hey Kevin, you didn't indicate whether you want the alert to happen if the three or more failed logins are coming from the same user. In case you don't care about the user use this search: "failed login search" | stats count by host | where count >= 2 And create an alert with an alert condition "number of events" "is greater than" 0. If you do care on a per user basis, use this search: "failed login search" | stats count by username, host | where count >=2 And create an alert with an alert condition "number of events" "is greater than" 0.\ Naturally you will have to replace "failed login search" with your search for failed login events. ... View more

Just got done reading through the convoluted stream of answers and comments again. To sum it up, your problem is: If you add the account to the Domain Admin group, you can poll WMI fine, but your sysadmin does not allow this configuration. You followed the manual in setting this up for a non admin account Now when you say it doesn't work, do you mean querying via splunk cmd splunk-wmi -wql "select * from win32_service" -namespace \\<server>\root\cimv2 or via a different method? If you run the splunk cmd, do you receive an error? If so, can you please post that error? If you are not getting anything, or rather, if you are getting something similar to this: Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp. Then you probably left the initial splunk off of the splunk cmd command and just invoked another shell with cmd . Please also post details on the account you are running the polling splunk instance as. Domain account, local account, local SYSTEM account? ... View more

Saw that many answers revolve around adding the account to the Local Administrators group on the DC. This is indeed possible on a 2003 DC. Simply add the user to the BUILTIN\Administrators group on the DC. One thing to note is that the Domain Admins group is a member of BUILTIN\Administrators group, so if you already added the account to Domain Admins the account should have (out of the box) loca admin privs on the DC. ... View more

You will want to modify the updateCheckerBaseURL in your web.conf: serviceFormPostURL = http://headlamp.Splunk.com/event/add userRegistrationURL = https://www.Splunk.com/index.php/pre_reg?destination=prod_reg updateCheckerBaseURL = http://quickdraw.Splunk.com/js/ * These are various Splunk.com urls that are configurable. * Setting updateCheckerBaseURL to 0 will stop the SplunkWeb from pinging Splunk.com for new versions of itself. So basically you want to add a web.conf at $SPLUNK_HOME/etc/system/local/web.conf with the following: [settings] updateCheckerBaseURL = 0 Then restart splunk for the settings to take effect. ... View more