No worries. Those are items I am telling it to NOT look for. the "!" in front of the "=" means "NOT" 🙂 So in your case... Account_Name!="*$" is the same as you saying "NOT Account_Name="*$""     ... View more

Is this script too slow to deploy for your organization? I have a powershell script that we use at my organization. I can share it with you if you'd like.   ... View more

Try this search. I saved it a while back and its been useful. You may have to modify it to match exactly what account names you don't want to track. source="wineventlog:security" action=success Logon_Type=2 (EventCode=4624 OR EventCode=4634 OR EventCode=4779 OR EventCode=4800 OR EventCode=4801 OR EventCode=4802 OR EventCode=4803 OR EventCode=4804 ) user!="anonymous logon" user!="DWM-*" user!="UMFD-*" user!=SYSTEM user!=*$ (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10) | convert timeformat="%a %B %d %Y" ctime(_time) AS Date | streamstats earliest(_time) AS login, latest(_time) AS logout by Date, host | eval session_duration=logout-login | eval h=floor(session_duration/3600) | eval m=floor((session_duration-(h*3600))/60) | eval SessionDuration=h."h ".m."m " | convert timeformat=" %m/%d/%y - %I:%M %P" ctime(login) AS login | convert timeformat=" %m/%d/%y - %I:%M %P" ctime(logout) AS logout | stats count AS auth_event_count, earliest(login) as login, max(SessionDuration) AS sesion_duration, latest(logout) as logout, values(Logon_Type) AS logon_types by Date, host, user ... View more

Good luck! It definitely sounds easier to send it to a different email and have a rule in outlook to forward that email.  Either way glad you found the issue. ... View more

You can configure your syslog server to rotate daily.  Depending on how your server is set up, you can check the settings for it in cron. Try a command like  ls /etc/cron.daily/ | grep logrotate You can also check your settings in /etc/logrotate.d/rsyslog . For more information, google search " How to setup and manage log rotation using logrotate in Linux" ... View more

In /opt/splunk/etc/auth there should be a server.pem file. Rename it to server.old and restart Splunk Enterprise. That should resolve your issue, if not, check mongod.log. 🙂 ... View more

You can use a search like this to create a dashboard for your homepage. index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity" ... View more

Strange, and I'm assuming that the problem alert isn't the only alert on that SH in that environment? Are you able to send the results of that alert to a different email? That would answer the question if it's something between the SH and your inbox. I doubt it though.   ... View more

Is there a chance that data is being duplicated? Run a search like index=_internal source=*license_usage.log for data up to 3 days ago.  ... View more

Its possible, Unless you have Splunk MLTK you might have to do some statistics 🙂 Take a look at this article that talks about how to identify the an outlier and then use IQR to identify outliers.  https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/Findingandremovingoutliers  ... View more

Is that the only alert having this issue? Could there be a setting throttling your results?  Could you manually recreate that alert? ... View more

Are you looking for hosts with forwarders installed that havent reported to Splunk in some time? You can use the Monitoring Console to view that.  To view the missing hosts, you can click on the Forwarders tab and then Forwarders: Deployment. For an alert, go to the Monitoring Console -> Settings -> Alerts Setup. There is an alert named DMC Alert - Missing Forwarders. Note: A forwarder shows a status of "missing" if it has not connected to indexers within 15 minutes ... View more

My suggestion would be to manually edit the props.conf for your hosts to set the TZ. Please see check this link for an example and TZ attributes: https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Applytimezoneoffsetstotimestamps  Another option would be to set up an NTP server and point all hosts and Splunk servers to that server.   ... View more

  Is Splunk refusing to (re)index the same files again, even though they are going to different indexes? Yes that is correct. Splunk will not re-index data that has already been indexed. Also, I thought the commands I typed would end up in "/opt/splunkforwarder/etc/system/local/inputs.conf"? But I only see "[splunktcp://9997]" in it, not the folder I'm monitoring. Am I looking at the wrong file? Thats where I would expect it to be. You could check for  /opt/splunkforwarder/etc/system/default/inputs.conf So why did my indexer configuration become part of the config file? Preferably, I would like to configure the forwarder using the config files, but I'm not sure exactly which ones to modify - local/inputs.conf and anything else? Your indexer configuration became part of the config file because all configurations within Splunk are stored as conf files.  If you would like to configure forwarding using the config files then yes you can modify the local/inputs.conf.  You may have to restart the forwarder depending on what you add to it. However, when we have to add new inputs we will create an app which contains a new inputs.conf. Then that app can be managed and updated without having to touch the forwarder. 🙂   Hope this helps! ... View more

CM must be placed into maintenance mode before upgrading. ... View more

Hi Prashanta,  Please doublecheck your firewall settings. Splunkd.log may also give you additional information. If you could give more information on what exactly is going on, that would help. ... View more

No worries, one of those 22 apps may have a script that is modifying the Forwarder's deploymentclient.conf. Typically it would be in a folder called 'bin' in the app's folder. Do any of the names of the apps in /deployment-apps/ sound like it could have configuration files for the forwarders that connect? What apps were pushed to the server with the Universal Forwarder on it? It will be in $SPLUNK_HOME/etc/apps/ You could look in the apps on there for a script. It should be something like:  $SPLUNK_HOME/etc/apps/(appname)/bin/script.ps1        ... View more

In $SPLUNK_HOME/etc/deployment-apps/ there could be an app that contains a script. Also, is your deploymentclient.conf file in $SPLUNK_HOME/etc/system/local or in an app? ... View more

Well if someone has the access to modify your indexes.conf yes, they can add an index. Adding another indexer to your Splunk deployment requires them to know your Pass4SymmKey. Without that, they can't add an indexer to your Splunk servers. ... View more

Is it possible your Deployment Server has a script that is pointing the deploymentclient.conf to that other TargetUri? ... View more

splunk-powershell.exe is used for some of the modular inputs for windows specific devices. If you look in a inputs.conf on your Universal Forwarder, there are stanzas that start with [powershell://.............................]  That is what splunk-powershell.exe references. ... View more

Im assuming you've checked the $SPLUNK_HOME/etc/apps folder for the name of the app. You could try looking in $SPLUNK_HOME/etc/master-apps, $SPLUNK_HOME/etc/slave-apps, and $SPLUNK_HOME/etc/deployment-apps?   If you run your Splunk servers on linux, i would also suggest using a command like "find /opt/splunk -name "app name" " ... View more

Hey, I know barely little on programming but we have four syslog servers which accept logs and forward to Splunk.   How we do it, we have a server we designate as a "syslog server" with a universal forwarder on it.  In the /etc/rsyslog.d/external.conf we have rulesets and inputs configured for the types of servers we have. Since you will only forward logs for routers, I doubt yours would be complicated 🙂 After configuring your syslog, then you can configure the inputs.conf to monitor that directory.   The free version of Splunk should be more than enough to monitor your router's logs. So you shouldn't have to install a universal forwarder on a separate machine,  and then forward that to your Splunk server. Hope this helps, let me know if you need a little more guidance. ... View more