It looks like in your configs you have nestedGroups repeated with different values. I believe the 1 will take precedence since it comes last but may be wrong. Also, give changing the value of groupMemberAttribute to member instead of memberof and then reload the authentication configuration and give it another shot. ... View more

When trying to authenticate does it take a while to fail or does it fail immediately? When mapping to large DNs there can be issues with retrieving a large number of groups/users so I'm curious if it could be hitting the timelimit. If it fails immediately then it likely isn't that. ... View more

Are you assigning LDAP groups that contain nested groups/users to Splunk roles? There is an additional setting to allow for traversing nested groups that if you don't have enabled it will see the group as not having any users. There is a blog on this here: https://www.splunk.com/blog/2012/02/23/splunk-and-nested-groups-for-authorization.html. The setting you would have to update is in your authentication.conf and you would need to add nestedGroups=1 . Additionally, the OU where the user resides has to be visible to Splunk as well. When you look at authentication.conf and it says "DO NOT EDIT", I would guess you are looking at $SPLUNK_HOME/etc/system/default/authentication.conf. You should never edit anything in the default directory but you can add your own settings in $SPLUNK_HOME/etc/system/local/authentication.conf. That is where the configurations you have made in the GUI will appear. ... View more

What is the sharing level on SA-ldapsearch? If it is not exported globally it will work within the SA-ldapsearch context fine, but will not be seen by other apps. ... View more

The links copied in are more related to the fact that _internal and thus license_usage.log is only retained for 30 days and then it's buckets freeze by default. So that would be why you can't retrieve license info for days <30 days out. Can you run any searches from the license master? ... View more

Are you managing your forwarders via deployment server? If so, you can push the change out via inputs.conf for each input from that. ... View more

In order to have a running report for 24 hours with those intervals what I would do is to schedule the report for every hour with a search range of the last 4 hours. This will give you the available memory for a single 4 hour period in which you can add to a lookup table as a part of the search. Within the search we can build in logic to only retain a specific range of data in the lookup and say if a row in the table is >24 hours old, drop it from the table. Do you have a search to work with? ... View more

index=_internal source=*license_usage.log type="Usage" idx=* st=* | rename i as guid | join guid [| rest splunk_server=<cluster_master> /services/cluster/master/peers | rename title as guid | fields guid label] | bin _time span=1d | stats sum(b) as b by _time, label You can add/remove values as you need and adjust time as needed. What this does is just pulls guid/label info from the master and joins it to the guid. If you aren't clustered we might have to find a different endpoint to hit to grab that info. ... View more

So it does look like it uses an index macro. I must have been looking at the wrong F5 Network app. Then my answer still applies. Go to Settings-->Advanced Configuration-->Search Macros and find f5_index . You should see it define index=. Just change that to main and it should change throughout the entire app. ... View more

If you use the WinEventLog monitor (https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Windows_Event_Log_Monitor) it shouldn't care about the log rolling. It doesn't actually care about the log file itself as it monitors the specific event log channel rather than the .evtx file. ... View more

What index is the F5 data stored in? Does your role search that index by default? Either way, the app should specify an index macro, but it only does sourcetypes. If you don't have the index searched by default it won't point to an index to search. You can update this in Settings-->Advanced Configuration-->Search Macros and then navigate to the F5 app. For each of the macros append index=<your-F5-index> to the beginning of the macro. ... View more

Has anything on the system recently been restored from backup? Was _internal disabled manually or by Splunk itself? You can look for something like this in splunkd.log that can help tell you where the problem is: 06-20-2019 23:06:05.513 +0000 ERROR IndexProcessor - One or more indexes could not be initialized and were automatically disabled, please see splunkd.log for more details 06-20-2019 23:06:05.512 +0000 ERROR IndexProcessor - caught exception for index=_internal during initialzation: 'Splunk has detected that a directory has been manually copied into its database, causing id conflicts [/opt/splunk/var/lib/splunk/_internaldb/db/hot_v1_1, /opt/splunk/var/lib/splunk/_internaldb/db/db_1307563383_1307490866_1].'.Disabling the index, please fix-up and run splunk enable index If this is the case, Splunk would need to be stopped, bucket collisions remedied, indexes reenabled, and then restarted. A good answer on this can be found here: https://answers.splunk.com/answers/30986/why-is-my-index-disabled.html. ... View more

Unless you customized the install folder, it would be "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" btool inputs list > C:\Users\user\Downloads\btool.text" by default on Windows. ... View more

Yes, by default a Splunk alert is all or nothing, but it is possible to dynamically alert with a little work. ... View more

I would say you can, but it will take some work to create the search logic and lookup tie-ins. You can dynamically send emails to different groups based on results using something like sendresults (https://splunkbase.splunk.com/app/1794/). You can run a search that looks for account lockouts, query LDAP (https://splunkbase.splunk.com/app/1151/) for the group and see which IT team they are assigned to, and send result only to that team. Depending on the size of your AD you may want to schedule a search once a day or however frequent you need to pull the relevant AD information and output to CSV lookup in Splunk so your search looking for lockouts isn't constantly hitting LDAP. ... View more

What are you using to display the data? Those base searches will only return raw results and not a stats/visualization. index=EventEndpoint | eval date=_time | table date _time will show you the time in both epoch and human readable time. ... View more

So Splunk doesn't monitor the files but the event log channels itself. You don't want the full path but use the built monitors like you have listed. Documentation on these are available here: https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Inputsconf#Windows_Event_Log_Monitor. The add-on Splunk_TA_windows also has an inputs as well as other useful parsing for these logs you can use. That is available here: https://splunkbase.splunk.com/app/742/. ... View more

One thing I forgot is _time actually is already in epoch but just displayed human readable in Splunk UI. All you would need is | eval epoch1=_time ... View more

You are trying to get the field _time itself to display epoch? What is the full search? I don't believe you can actually overwrite _time so have to use the other field to display epoch. ... View more

I've been continuing to test filtering based on the method in which a field is created. Here is what I have so far: REPORT for string = YES REPORT for number/ip = Kind of (appears to filter on value but ignores field) FIELDALIAS = YES LOOKUP = NO EVAL = NO The IP/number part is the painful piece. Not sure if there is some setting I'm missing or what but it's kind of important to be able to use those fields for stats. Also painful is I'd have to clone sourcetypes for this and remove those fields that don't work for filtering (since they still appear in the extracted fields) and maintain it outside of the vendor managed TA. You might be able to manipulate the search a bit to avoid the search optimizer to allow filtering to be done on the search head in some cases but the typical user wouldn't know to do that. The LOOKUP and the EVAL not working on the Hadoop side makes sense to me, but the REPORT IP/Integer is throwing me through a loop. ... View more

So I think I might have found the issue. It looks like when running filters using fields that are created via and EVAL in props.conf it ignores the filter. The filter is working when the field is created via REPORT in props+transforms as well as when the field is created via FIELDALIAS. It can be deceiving having those fields get extracted by the search head but ignored by Hadoop since it looks like they are available to filter on. Also makes it so I'll have to create a new sourcetype separate from the Palo Alto created add-on for CIM so that I can modify the way in which the fields are created. ... View more