This one just refuses to roll over and get solved, doesn't it?! Usually @atarewari it IS very easy to be honest - at least iro getting data in...and prima facie your spec is simple. We all have complications but usually of our own derivation / environment on the non-standards - but thats later. Stick with it - Splunk is an awesome tool. So to recap - ... View more

Your 2nd server with the forwarder on it needs to be firing at index 'os'...that's all. If its only those 2 servers then 9997 is fine, but we segregated out star-nix traffic from Windows, sending the former to (say) port 9996, then told the indexer's Data Inputs params (see Manager if you prefer GUI) under 'More Settings' to populate the index 'os'. We work in a highly secure environment complying to auditable Government levels, so need both. ... View more

Atewari - not wishing to tread on Drainy's toes 'cos he is a good 'un and very solid....my two-pennneth relates purely to that of experience with the star-nix (am still trying to work out the tagging variables here) plug-in. Level playing field - you say summary page - by that you mean star-nix's...or Splunk's Search page? Portal being standard Splunk access?? We don't tend to use that word too much around here, albeit it will be a portal for someone, being web access. ... View more

Drainy and Atewari - I stuck my hand up earlier on a feature of star-nix but not sure if you clocked it, or didn't need it...no worries either way. You said 'We added the star-nix App", but it cannot see server2 selection anywhere'....well, tbh you won't until you get the index 'os' sorted out. Traffic to *nix is expected in that space. Cheers, Dave ... View more

Atewari - note Drainy's comment here re different index in outputs.conf. You currently don't have that in the rundown below. Note especially that *nix uses the index 'os' and all canned searches are pre-disposed to that source! Br and good luck. Dave ... View more

Lastly - it is worth going the perfmon.conf route. Splunk docs has more on it here: http://docs.splunk.com/Documentation/Splunk/4.2.3/ReleaseNotes/Workaroundtoadd64-bitWindowsperfmoninputs You may find that you don't have a perfmon.conf operational i.e. there is an example file in ../etc/system but not in /system/default..nor in your ../system/local as yet. Use the example file as your template and save it to local per usual. Then restart the service. ... View more

Rick. Ok - I assume that JMETZGER-PC is the source with the UF on it, not the host indexer, and that you still only see WMI:stuff from the latter...and that JMETZ..is sending other data through e.g. it confirms the UF started? If the above is true then try 2 things: 1) deep dive into the Splunk internal indexes for perfmon errors using: index=_internal source=*splunkd.log perfmon 2) Just check that the PC with the UF on it does have Splunk running with system permissions - sufficient to initiate the performance monitor? Br, Dave ... View more

Slowry - Ayn is right - post your q's re WI and Windows Mgmt as new q's - the tagging system works in your favour and you will be able to see 'related' if not similar q's people have had. The user experience on the App's release page makes for good reading at http://splunk-base.splunk.com/apps/22315/splunk-app-for-windows Br, Dave ... View more

Nice one Dave, and thanks! Voting this one up. ... View more

I see that others have commented on the product integration, and with some success. Whether their needs are quite so immediate is not clear, but in this environment they usually are (ours are, or to quote some squirrely terms from contracts 'as near real-time as possible'). I don't know the answer re turbo-ing the script (and am assuming you have thought of, or already use forwarders?)but you may be best supported by Splunk Support by raising a ticket with them, unless some of the other guys on here can comment? Good luck. I'll follow this with interest. ... View more

Interesting...because we are about to do the same. Where is the 'lag'? What is your business driver - I ask because if it's Remote Monitoring slanted e.g. traps / alarms you could use 'tool of your choice' and use Splunk as the single pane of glass with some integration work. ... View more

Splunk support an OPSEC Log Export API - take a look at: http://splunk-base.splunk.com/apps/22386/opsec-lea-for-check-point-linux Br Dave ... View more

Good luck!I'll follow this thread to see if it worked & will change the question to 'a' (potential)answer to help others. ... View more

Rick - I take it you have checked Computer Management (compmgmt.msc from the command line) and that under Services, 'Performance Logs and Alerts' is Started? Best make it persistent as well? Br Dave ... View more

Further thoughts - have you tried starting Splunk manually to see where in the startup sequence it is failing? /program files/Splunk/bin/splunk start or ..splunk start --accept-license for good measure? ... View more

Hmm...am not sure if it can 'wait' to find that param out, maybe it can. I didn't see it above, but there is another param if you are using a deploy server (DEPLOYMENT_SERVER="hostdets:port")? The GUI option was the other suggestion, yes. However if you are entering the same info / or not, it may just be replicating the issue. Can you try (either) with the FORWARD_SERVER...? ... View more

Anoopambli - did you set FORWARD_SERVER="destserver:port" so that the forwarder knows where it is sending logs to? Are your domain rights / account ok, members of local Admin Group etc (maybe you are domain admin ;-)? ... View more

ja_s...I understand re security eventlog. I ran it (on 4.3) and did not have any errors. My v5 lab is down at the mo'...will try there. tag::user="foo" at search line worked as well. ... View more

Try this (sorry - a bit slow tonight). Create a new tag with name of ANON_LOGON, add field value pair of user="ANONYMOUS" and another value of action="login attempt". If that fails, try running the search manually. My test was: user="admin" action="login attempt" | top user host source sourcetype | fields - percent But I was using "admin" because I know I have those and no anons in the indexes. You may also need to create more values for user="anonymous" OR user="ANONYMOUS" ... View more

Tags names don't have quotes, nor spaces. If you really want the tag name to be similar to that it then use ANONYMOUS_LOGON as its name.Field Pair value would be user="ANONYMOUS" etc? ... View more

Not tested - but Splunk usually likes field names with spaces in them to be represented within a set of quotes? "ANON LOGON". Edit - you have seen ANONYMOUS LOGON in a log coming through? I ask because the standard convention for Windows is ANONYMOUS on its own. Logon is a separate field? ... View more

Meant to add...build-your-own is worth the investment. You are likely to be called upon to demo Splunk A LOT. It's popularity goes viral inside a business. After that you could manage take-up as proof of concept projects. ... View more

As an Architect, I had the same challenge. I took the long route and created a test bed. Finding log data isn't likely to be your issue - machines and appliances are chatty enough. Once you have your first instances up and running you will have more than enough! 😉 The benefit of using your own data is relevance. Relevance to the business and therefore recognition. If its a general demo capability then attend a Splunk Webinar. Splunk offer the content. Lastly - perhaps consider talking to your Splunk partner - they usually have a lot of collateral, cleaned up and could help? ... View more

I like that J. Elegant and simple. The server that Splunk is running on may not be dedicated to just that service so this is catered for. ... View more