I was thinking the same thing, but when I plugged in 0 instead of 7 Splunk gives me an error of invalid cron_schedule.  Now I did get 1 to work, but that was not helpful and seems the job will start on Nov 1st and then run everyday according to crontab.guru.   travis ... View more

When I click on the link for https://crontab.guru/#00_12_1,2,3,4,5,6,7_*_0  the next run date is at 2022-10-23 12:00:00 which is not the first Sunday Nov 6th 2022.   I did some digging and found if you use the following: 00 12 1-7 * */7 (https://crontab.guru/#00_12_1-7_*_*/7) in crontab it appears to be what you are looking for.   However when I attempt to use that cron in a Splunk schedule it does not work.  It appears that Splunk is not like the every 7th day trick */7.   Reviewing Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/Alert/CronExpressions It appears the only values that can be used are 0-6.  Not sure if at this time if there is a way to run on the first Sunday of the month with cron in Splunk.  travis ... View more

Have you tried creating another HiddenSearch module before your ViewRedirector. This should pass your click value down to that hidden search which will output to a new window with the view redirector. For the time part need to play around a little. travis. ... View more

If you haven't tried Splunk 4.2.2 they have updated splunk_regmon.exe and able to monitor the keys I wanted. travis. ... View more

I use ResultsHeader module after a HiddenSearch module in my advance XML dashboards which will display the following: 123 results in the last 60 minutes (from 2:28:00 PM to 3:28:50 PM on Wednesday, April 20, 2011) in your dashboard. Example of the module in my XML: <module name="ResultsHeader"> <param name="entityLabel">results</param> <param name="entityName">results</param> Then make sure to close it out. Another option you could play with is SimpleResultsHeader, specially when working with drilldowns: <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">$time$</param> </module><!-- SimpleResultsTable--> Link with more info: http://www.splunk.com/base/Documentation/4.2.1/Developer/ModuleReference#ResultsHeader Hope this helps Travis. ... View more

Not sure if there is a Splunk standard, but it does make it nice to come up with a standard naming convention to organize your searches. For example I begin some of my search names with audit (ex: audit_fails, audit_successful). Then under my app I go into manager - user interface - navigation menus - default and added the following under So any time I create a search with the word audit it automaticly gets placed in the searches menu . I have another for my Database searches that I start with db_ (ex db_group1, db_group2) so it can get organized in a menu just for them so I am not scrolling through my other search to find them. Some good reading would be: http://www.splunk.com/base/Documentation/4.2/Developer/Step6BuildNavigation This one talks about the helpfulness of naming conventions: http://www.splunk.com/base/Documentation/4.2/Knowledge/Developnamingconventionsforknowledgeobjecttitles Hope this helps Travis. ... View more

So you just want to setup a search to run every 5 minutes and report on the previous 5 minutes to alert of any failures greater than 5. How about this: (your search for fails) earliest=-5min | stats count by user,host,_time | search count>4 ... View more

Maybe something like this for a search: (your search for fails) | bucket _time span=5m | stats count by user,host,_time | search count>4 After that save the search and set it up as an alert. Hope this helps Travis. ... View more

Looks like you are using the Simple Dashboards and I am referencing Advanced Dashboards. Never tried to use the SearchBar module in a Simple Dashboard and I would recommend switching to an Adv. Dashboard since you can customize it more. Good starting point is http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard from there you should see other articles about Adv. Dashboards. Also splunkbase has example UI dashboards you can look at: http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+UI+examples+app+for+4.1%2B Hope this helps. Travis. ... View more

I currently have dashboards setup with a search bar at the top and charts/tables under it. <module name="SearchBar" layoutPanel="mainSearchControls"> <param name="label">true</param> <param name="useAssistant">true</param> <param name="useTypeahead">true</param> <module name="TimeRangePicker"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module><!-- /ViewRedirector --> </module><!-- /TimeRangePicker --> </module><!-- /SearchBar --> Then after this you will just create your other modules that you want on the page. Next question is where do you want your results to show after you run this search? With the above setup it will redirect your current page to display the results. Not sure if you need the results to appear on that dashboard or open a new page. You will just need to play with the ViewRedirector part. If you want it to open a page and leave the current alone just add: <param name="popup">True</param> After <param name="viewTarget">flashtimeline</param> Hope this helps. Travis. ... View more

Question what permissions does your saved search have and what app is that saved search associated with? Travis. ... View more

Thats what I figured but it's not working like I want it to. More details are in this post of what I have tried. http://answers.splunk.com/questions/10687/regmon-filters-not-working I am able to get a baseline for my filters but it will not monitor changes. Travis ... View more

After some more work I found that in sysmon.conf you can set active_filter = "Run", "RunOnce", "rest of your filters" and you will not need the User & Machine key entries in regmon-filters.conf like I had above. With this setup I am able to get a baseline, but it will not see any changes that I make to the registry. Still looking into it. ... View more

Question, instead of black list filter can the white list filter be setup the same way? I am interested in monitoring certain hives and having no luck with white list in regmon-filters. Only thing I have not tried is to setup a black list for everything else I don't want in the registry. ... View more

Ok I take that back on which filter gets used. From Splunk Web - manager - data inputs - registry monitoring the first one listed seems to be the one that gets used. ... View more