Hi, I have successfully installed Splunk DBConnect and also successfully connected one database. However, when I tried to connect second database, I received the following error message: Encountered the following error while trying to update: Splunkd daemon is not responding: ('The read operation timed out',) Is there any one can help to solve the problem? Thanks in advance! ... View more

Hi all, I found a problem when I migrate Splunk from Windows server 2003 to Windows server 2008. I created a alert for local or global groups changed. It works well in Windows server 2003. But in Windows Server 2008, there is only Sid, no Account Name. Here is an example. If I add myslf into the administrator group. (I have changd some real information....) Thank you in advance! In windows server 2003: SourceName=Security EventCode=636 Type=Success Audit ...... ...... Message=Security Enabled Local Group Member Added: Member Name: - Member ID: AP\zyxcc Target Account Name: Administrators Target Domain: Builtin Target Account ID: AP\Administrators Caller User Name: zyxcc Caller Domain: AP ...... But in windows server 2008, there has Sid, but no account name for the member's information: SourceName=Microsoft Windows security auditing. EventCode=4732 ...... ...... Keywords=Audit Success Message=A member was added to a security-enabled local group. Subject: Security ID: S-1-5-21-981343549-14154652-165423545 Account Name: zyxcc Account Domain: AP Logon ID: 0x51ed123 Member: Security ID: S-1-5-21-981343549-14154652-165423545 Account Name: - Group: Security ID: BUILT\Administrators Group Name: Administrators Group Domain: Built ...... ... View more