nevermind, i see my mistake. additional note: i was getting peridoic emails with no numbers, i noticed that the active directory app doesn't seem to pick up src_nt_domain from 2008 r2 domain controller events properly. i hard-coded my domain in the ldap search as i only have 1. thanks for you help again. ... View more

You have the one of the TA-SQLServer technology add-ons on your server. This contains the dm_audit_class_type lookup as an automated lookup. You have two choices: 1) Edit the props.conf in the TA-SQLServer that you have installed to remove the automatic lookup. 2) Export the lookup table in the TA-SQLServer that you have installed to remove the warning. Either is a good approach. Note that the new Splunk for SQL Server beta opts for option #1. ... View more

Maybe I'm not explaining it right. The data is coming in tagged as "domaincontroller.domain", but I want it to be tagged as "domaincontroller". All the other data from the same domain controller, using the universal forwarder, is tagged as "domaincontroller". Why are the fields for the security stuff tagged differently? ... View more

Hi - by any chance can someone please supply the transform statement for extract_transport -- it is still missing in the current (v6) version as well - I have commented it out for now, however hoping to correct it if possible please ... View more

Found my problem... I renamed the app directory to fit our particular deployment, and the script at bin/check_my_reputation.py calls the app directory by name in this section: def readConf(confName): app_dir = os.path.join(os.environ["SPLUNK_HOME"], 'etc', 'apps') app_path = os.path.join(app_dir, 'TA-SMTP-Reputation') I had to rename the app_dir to match our directory name. After that the script ran ok. ... View more

Thank you for your reply, I checked. Can you give me imformation on the name of the performance counter object and the counters used for the query. Thank you ... View more

Hi @mameisberger, if my Heavy forwarder is already forwarding all data to the indexer by default, do I still need to create a forwarder on it ? ... View more

Same issue here, I found out that the field "src_ip" that the dashboard is using doen't exist in the events. So obviously the dashboard can't display anything... Any idea why this field doesn't exist on events ? ... View more

Thanks Adrian! ... View more

Is there any fix for this problem ..we have the same issue ... View more

Thank you! ... View more

It's probably because you did not re-generate the lookups required by the app, so you will have to wait for them to generate themselves, or run them manually. ... View more

You can easily nest things by using the other LDAP commands in the package. For example, using |ldapsearch domain="X" search="(CN=#*)" attrs="distinguishedName"|ldapgroup You get an expansion that actually shows the membership in a field called memberDN. You can expand this with ldapfetch: |ldapsearch domain="X" search="(CN=#*)" attrs="distinguishedName"|ldapgroup|mvexpand memberdn|table cn,memberdn|ldapfetch dn=memberdn attrs="mail"|table cn,memberdn,mail Check out the specific documentation within the SA-ldapsearch app, that has explicit examples for each of the four commands. ... View more

Well my enterprise cannot and doesn't want to access to the clients' servers, in (very) short. This might change in the future though, so, I'll use this "question" again here if needed. Thanks for the information, you've been much help! ... View more

Hi Ahall, I finally fixed it. You were right, the fields in the transforms.conf for mswin_2003_iis_fields were off, there were some fields that are not included that's why the values for cs_uri_stem were not correct. Everything's seems to be showing now. thanks a lot. ... View more

If you don't have SMTP configured, you won't see inbound or outbound messages - they are delivered via SMTP. ... View more

I finally just fixed this by deleting my eventtypes.conf, macros.conf, and savedsearches.conf in my Splunk_for_ActiveDirectory/local folder. Then I copied my eventtypes.conf and macros.conf to local and edited the 'index=' references again and everything started working again. ... View more

Now that you have perfmon data, take a look at the other data. Please post a list of source types that you are getting data for within the msexchange index. ... View more

Hi, we have the same issue, we are having a mixed environment, some english servers in Amerika and some german servers in Germany. Most of the App Dashboards and collecting jobs on the server side are not usable for our german systems. How can we get them into the game? Kind regards, Sebastian ... View more

If you are evaluating Splunk, then please contact your friendly Splunk sales rep for assistance. ... View more

If thats the whole of outputs.conf, then there is no IP address of your indexer there. Take a look at this page: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configureforwarderswithoutputs.confd You can create a TA-forwarder on your deployment server and push an outputs.conf file out to your forwarder if that piece is working. ... View more

Thanks for the pointer - we'll get the docs corrected. The directives you point to are not required on the indexer - just create the indices and you should be fine. ... View more

If you have a paid version, open up a support case. I think you have given me enough to work on, though. Since it happens in all browsers, it should be easy enough to track down. ... View more