I fixed the formatting for you. When you have a bit of code or output, select the text and click the "101010" button. That will preserve linebreaks and make things easier to read. ... View more

I did a lot of editing of the follow-on comments, converting them from answers to comments. I then accepted the prevailing answer which does seem to be correct. P.S. folks, please try to only add a new "Answer" if it is answering the question at hand. Otherwise, just click in a comment box area to add a comment that's related either to the original question, or to one of the existing answers. That helps to keep the site clear of clutter and makes it easy for the next person to actually find the answer to their question. TIA ... View more

I did a lot of editing of the follow-on comments, converting them from answers to comments. I then accepted the prevailing answer which does seem to be correct. P.S. folks, please try to only add a new "Answer" if it is answering the question at hand. Otherwise, just click in a comment box area to add a comment that's related either to the original question, or to one of the existing answers. That helps to keep the site clear of clutter and makes it easy for the next person to actually find the answer to their question. TIA ... View more

Marking as accepted answer based on input from another customer whose issue was resolved. ... View more

I gave ya points. 🙂 ... View more

I like this version. It comes out close to 50% faster in my slightly-scientific tests. Thanks! ... View more

Not sure which to pick! 🙂 ... View more

Hi, please note that to get the best out of the Answers website, you'll want to use it as a Q&A site, not a forum. Only create new answers if you actually are answering the original question. Otherwise, use the "add comment" or "reply" links. ... View more

What version of DOT are you running? Note that C-mode and 7-mode are distinct from the DOT version. The minimum supported DOT version is 8.0.2 as per the docs. ... View more

While I think going the ldapsearch route will make more sense, I'll answer your other question as well. You can certainly configure the Windows forwarder to pick up a CSV file. Doing so would create events in Splunk--not a lookup table. To do this, you would follow the steps in the indexed field extraction section of the Getting Data In book which deals with "files with headers". Since the forwarder doesn't have a UI, you'll need to edit the inputs.conf and props.conf files. If you are new to this, The easiest route would be to quickly install Splunk on your workstation (you can set the services to manual so they don't run all the time if you want). Then in splunkweb, go to add a new file input, and it'll walk you through the steps of creating the right props and input settings. You can then put those files on the forwarder with very little modification needed (such as the path to the CSV file). Once you have that part figured out, just have the forwarder watch the file, and it'll update the file as soon as your script writes it out. Seconds later, you can search that data in Splunk. Now, these won't be lookup tables. That may or may not matter for your scenario. Next step for you would be learning the right search commands to compare these fields and so on. ... View more

I suggest going with the SA-ldapsearch app (Splunk Support for Active Directory) which I think you have already considered. I am 99% sure that works on any of our supported platforms. I've also sent feedback to our docs team to clarify that this is the case. Then you can do everything from Splunk. You would create a search using the ldapsearch command and either populate a lookup table using the outputlookup command, or include your user activity comparison in the search pipeline to use the realtime data from AD. ... View more

There's an edit button on the top right under the little gear icon. But I went ahead and updated the URL for you. ... View more

@ahall_splunk, like most things in Windows, variables in PowerShell are case-preserving, not case-sensitive. http://technet.microsoft.com/en-us/library/hh847734.aspx ... View more

Converted to an answer for ya. ... View more

Try removing the existing modinput, then go to Setup and see if that behaves differently? ... View more

Before you start Grab the latest version of the app (v1.1 as of this writing) which has addressed a couple of bugs, and has a new app ID and name. The app requires that your Box account has admin console access. See this FAQ for more details. To configure the app/authentication: Go to Manage Apps To the right of the Box App for Splunk listing, click on the Setup link (example localhost link) Follow the on-screen directions to Login With Box which will initiate an OAuth permission request back to Box. Once back in Splunk, click the Save button. After a few moments, a confirmation will appear at the top that the app was successfully edited. This activity creates AND configures a Box modular input called "myboxinput". To confirm that the modinput is working, check to see if new events are being written to the box index. For example: index=box sourcetype="box-rest-api" The modinput writes errors to splunkd.log. Search for them with: index=_internal box component=ExecProcessor ... View more

Version 1.1 of the Box app has been published. The offending scheduled searches have been removed. ... View more

The app listing had an error which has since been corrected. ... View more

Please open a support case, as this appears to be a bug in the product that needs swift resolution. If you don't have a support contract, get in touch and I will help escalate the issue appropriately. Here's a docs link detailing support for CIFS. ... View more

If it's not included on the app download page, then I don't know what to say. https://apps.splunk.com/app/816/ ... View more

If you don't mind, please open a new Question asking this, and tag it with the CEE TA app tag by clicking this link: http://answers.splunk.com/ask/?appid=1742. I'll try to watch for it and answer there. ... View more

Try running it at the command-line with INFO logging level: -- if using lightweight forwarder: $SPLUNK_HOME/bin/splunk cmd python $SPLUNK_HOME/Splunk_TA_CiscoUCS/bin/Collect.py -l INFO topSystem If using Universal + system Python: python $SPLUNK_HOME/Splunk_TA_CiscoUCS/bin/Collect.py -l INFO topSystem And if you are running the TA on a Heavy Forwarder--let me know, could also be related. ... View more

Marking this question as answered for posterity. ... View more