Hi, If I have multiple matching TZ references in my props.conf on my indexer which one does it use? Is it just the one that comes first? For the host in question, it's Windows Event logs are in local time and another sourcetype is in UTC. I have a line in the props.conf that sets the TZ for the host to be the host's own time zone and another that set the TZ for the sourcetype to be UTC. It is preferring the HOST entry over the sourcetype entry. I suspect it is just taking the first match. Is that how it works? Cheers, Jeremy. ... View more

I'm trying to drop DNS requests for internal names from our Windows DNS logs. For a guide I am using an answer from this question: https://answers.splunk.com/answers/35259/best-method-for-pulling-microsoft-dns-logs-with-splunk.html We have two TLDs I'd like to filter out, for example bob.local and fred.local I've added the following to my props.conf: [win_dns] TRANSFORMS-drop = win_dns_ignorelogs And the following to my transforms.conf [win_dns_ignorelogs] REGEX =(?i)\.*(bob|fred)\.local DEST_KEY = queue FORMAT = nullQueue And restarted Splunk. One thing to note is that we have a SED command in the props.conf which replaces the standard formatting of the records from something like this: 13/12/2015 9:29:58 AM 0678 PACKET 0000000001FE2D10 TCP Rcv 127.0.0.1 4a3f Q [0001 D NOERROR] NS (8)bob(3)local(0) To something like this: 13/12/2015 9:29:58 AM 0678 PACKET 0000000001FE2D10 TDP Rcv 127.0.0.1 4a3f Q [0001 D NOERROR] NS bob.local Via and entry in the props.conf like this: [source::win_dns] SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g When I test the regex in search like this: sourcetype=win_dns questionName="bob.local" | regex _raw="(?i)\.*(bob|fred)\.local" It matches the events I am expecting to drop, but the events are still being indexed. Can someone please help me out? ... View more

I have a single UniversalForwarder which has stopped translating local SIDs to account names in the Windows Security log since I upgraded it from 4.3.3 to 6.2.0. Other than that, there have been no changes. Any idea how to troubleshoot this? The Forwarder is running Windows Server 2008 R2 ... View more

When editing server classes in the Splunk GUI, it cannot handle a comma in a regex. EG: \w{3}\d{1,3}\w Ends up being broken up into two different whitelists in the serverclass.conf file. Is this a bug? ... View more

I've just configured Splunk 6.0.3 using the GUI for AD authentication. I am able to save the configuration and map groups to roles and I can even see the group members when I do so, but no users are able to authenticate. Whenever I save the LDAP strategy name I get errors in the Splunkd.log as follows: ScopedLDAPConnection - strategy="my_ldap" LDAP Server returned warning in search for DN="OU=Users,OU=My OU,DC=mydomain,DC=local". reason="Size limit exceeded" ScopedLDAPConnection - strategy="my_ldap" LDAP Server returned warning in search for DN="OU=Groups,OU=My OU,DC=mydomain,DC=local". reason="Size limit exceeded" I know for a fact that the OUs I have specified only have about 20 users and groups in them. I've tried reconfiguring the limit from 1000 up to 1,000,000 with no success. I've tried adding search filters like (objectClass=group) although this shouldn't make a difference since each OU only contains the object types I am targeting. Is this a bug? What am I doing wrong? I have tried restarting Splunk too. ... View more