Pretty much all of the reports that are not under the Security Reports section require the PowerShell components. First, the good news. Some of the AD scripts can be re-written to use WMI remotely to gather the data. None of it is easy to get, but it is possible to do a lot of it remotely. Now, the bad news. None of it is easy to get, and no-one has done the work to translate the scripts to access the domain controllers or DNS servers remotely. So there is some significant script writing to do to get to the same point as is provided by the local PowerShell scripts. ... View more

Firstly, remove the space from the beginning of the search. Secondly, you have not specified an earliest and latest - even though the search does not care what these are, they still need to be present. The search will not be dispatches without them. ... View more

OL is correct - the Exchange and AD apps both deal with Powershell Version 2. Another (more global) way of doing it is to alter the exchangepowershell.bat script and add "-version 2" to the powershell execution arguments. ... View more

There are a couple of methods to do this, but they generally require a custom scripted input. My favorite is to create an email and send via direct SMTP to the cloud provider, directed at a mailbox inside your organization that drops mail on the floor. Your email should include a well-known subject (e.g. [TIMING TEST] ). Make sure you include the timezone in the date/time string for proper evaluation later on. In your SMTP logs, you do a search where the recipient is your dropbox and the subject includes [TIMING TEST]. If you are using the Splunk App for Microsoft Exchange, that search is: eventtype=msexchange-msgtrack source_id=SMTP event_id=RECEIVE recipient="mydropbox@domain.com" subject="*[TIMING TEST]*" Now, you can do two things here. Firstly, you can calculate the delay - simply extract the date/time that you sent the message from the subject, convert it to a timestamp with eval and strptime(), then subtract the timestamp from _time to get the # seconds between when you sent and when you received it. Secondly, you can detect when mail is stacking up by checking for the last time you received a timing test. If you send your timing test every 5 minutes and your delivery SLA is 1 minute, you can do an alert if you have not received a message within 6 minutes. I'd add a few seconds to that for delays in logging, so your search looks like: eventtype=msexchange-msgtrack source_id=SMTP event_id=RECEIVE recipient="mydropbox@domain.com" subject="*[TIMING TEST]*"|eval td=time()-_time|where td > 375|table subject,td Search over the last 10 minutes and convert to an alert. I've obviously taken examples from the Splunk App for Microsoft Exchange here, but you could adjust for any SMTP gateway. ... View more

You have the one of the TA-SQLServer technology add-ons on your server. This contains the dm_audit_class_type lookup as an automated lookup. You have two choices: 1) Edit the props.conf in the TA-SQLServer that you have installed to remove the automatic lookup. 2) Export the lookup table in the TA-SQLServer that you have installed to remove the warning. Either is a good approach. Note that the new Splunk for SQL Server beta opts for option #1. ... View more

The host field is set on the Universal Forwarder configuration, and we expect it to be the plaintext host without the domain, which is normally how it happens. Unfortunately, the app is not written in a way that support host.domain tagging for the host. You will need to modify the app to support that. Please feel free to file an enhancement request with out support group if you have a support contract. ... View more

You have a corrupt install of the Splunk App for Exchange. I'd suggest wiping out the default directory and replacing it with one that is fresh downloaded from Splunkbase. ... View more

This tells me the file it found in local/reputation.conf if not valid. ... View more

Another thing to check - you need to run the script via Splunk. So: root# splunk cmd python bin/check_my_reputation.py Try that! ... View more

Hey DavidTS, You are not having the same problem as OP as the fix suggested repaired his problem. Open up a new question and don't forget to include your Splunk version, Exchange app version, OS version and a copy of your domain_aliases.csv file! ... View more

Sorry - travel 🙂 There are a couple of reasons this could happen. The primary one is that you are running this on a Universal Forwarder. The TA-SMTP-Reputation needs to run on a full installation of Splunk. The second one is that there is something wrong with the reputation.conf. Finally, the script itself could be corrupt and needing to be replaced with a clean copy. ... View more

This search is specific to Exchange Web Services. If you are not using Exchange Web Services, this is an expected result. ... View more

The perfmon counters that are used are the US/English versions. Your french environment has french language counters. As a result, it won't work for performance metrics. You have two choices: Use something else for perfmon, such as Systems Center Operations Manager Alter the TA to collect the right perfmon counters, then alter the searches to also use the same names. Either one will work. You may engage our professional services team to do the adjustments if you do not feel you can do them yourself. ... View more

Something has changed on your deployment. The ad_username lookup is defined in Splunk_for_Exchange/default/transforms.conf and it's job is to normalize the username being presented in the IIS or message tracking logs into something that you can search for repeatedly. Lots of things break when this breaks. A few things to check: 1) Do a search in index=_internal to see if the script is mentioned with a more specific error message. 2) Check the permissions on the script itself (it's in the bin directory), plus the domain_aliases.csv file and the active_directory.csv file (the latter is an optional file, so you may not have one). 3) Ensure there are no blank lines in either of the CSV files. 4) Create an example CSV file to drive the lookup. It should have two fields - cs_username and user_subject. An example might be: cs_username,user_subject YOURDOMAIN\user user user@yourdomain.com Once you have this, you can feed this into the lookup and check the output, or errors. You do this with the following command line: splunk cmd python bin/ad_username.py < yourtestfile.csv Alter the paths according to where the files are stored. In this example, I created the file in the Splunk_for_Exchange directory and ran the command from there. If this doesn't point to the error, then please post the app version and splunk version. Also, if you have Splunk Support, then please open a case with our Support group for more specific assistance. ... View more

This is the first I have heard of it. Active Sync information is logged in the IIS logs, so please ensure that the IIS logs have the information first. If they don't, then you will need to fix the data source first. Also, check that the format of the logs have not changed. You can get the expected format by comparing the first ten lines of an IIS log file (one of them will list the fields) with the entry in the transforms.conf file. ... View more

Not as yet. ... View more

No. Your new location would be (for example), C:/Program Files/SplunkUniversalForwarder/etc/apps/TA-Exchange-2010-HubTransport/local/inputs.conf ... View more

TA-SMTP-Reputation has three requirements: It needs Python, so it needs a full Splunk install It needs Internet Access The index it feeds needs to be searchable from the search head The latter is only important in multi-tier deployments. You can just create the local directory underneath the $SPLUNK_HOME/etc/apps/TA-SMTP-Reputation directory. ... View more

There is a big long list there of event codes that your Active Directory systems should be generating. Take a look for eventtype=msad-failed-user-logons (which expands out to the big long list of event codes) to see if you are getting the data. It's probably not there. My go to reason is that there is a mistake in the audit settings for the GPO that is applied to the domain controllers. Since you are getting successful events, then take a look at the Logon Audit and Account Logon Audit and ensure that both Success and Failure is checked. ... View more

We have the updated bug. It will be looked at in one of our sprints. ... View more