great, it's working. Thank you, chris. ... View more

I don't know if there is an app already for this, but if you're just going to go off logs that tell you when people log on and log off, then you will need to maintain a state machine using lookups. I was pointed to this a while back and found it useful: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/ This would require a good understanding of the right logs and events to parse through to find the information you want.. Alternatively, you could set up a script to run when a user logs on/logs off that writes their username/IP address to a file.. which you can then Splunk. That's a bit of a hack though. ... View more

Great, it works! The field didn't exists, after adding extraction rule everything works. thanks. ... View more

OK, i finally did it. Problem was in routing, arp table and http_proxy variable. Now is everything working correctly. Sorry for disturbing 😉 ... View more

If you can't see the agents, make sure that the agent management inputs scripts are working correctly. The most common issue is that either agent polling hasn't been configured or that it is seeing a password prompt and aborting. First, make sure that you have configured the agent polling commands in ossec_servers.conf. Then run the following and looking for errors: cd /opt/splunk/etc/apps/ossec/bin ./ossec_agent_status.py ... View more