Ill take a look - thanks ... View more

Love it - thank you very much for your quit response - really appreciate it! ... View more

Tried the above string and not working - here is the response from Splunk - which their strings also do not work.... Hard to believe that deployment monitor is legacy and not going to be updated? Why would you dump support for a good app? Hi John, This appears to be a known bug in deployment monitor. Unfortunately deployment monitor is now a legacy app that is no longer supported for bug fixes. What one can do is take a look at the underlying query by clicking on "inspect": search index="_internal" source="*license_usage.lo*" type!=*Summary | eval lastReceived = _time | rename s as source st as mysourcetype h as host b as bytes o as originator | eval my_splunk_server = splunk_server | fields lastReceived source mysourcetype host bytes pool originator my_splunk_server source | stats sum(bytes) as bytes max(lastReceived) as lastReceived by mysourcetype | append [search earliest=@d index="_internal" source="*license_usage.lo*" type!=*Summary | eval lastReceived = _time | rename s as source st as mysourcetype h as host b as bytes o as originator | eval my_splunk_server = splunk_server | fields lastReceived source mysourcetype host bytes pool originator my_splunk_server source | stats sum(bytes) as bytes max(lastReceived) as lastReceived by mysourcetype | rename bytes as bytes_today ] | stats max(bytes) as bytes max(lastReceived) as lastReceived max(bytes_today) as bytes_today by mysourcetype | eval status = if(isnull(bytes) or lastConnected<(lastReceived-900),"missing","active") | search status="missing" | sort -lastReceived | fields mysourcetype lastReceived bytes status | rename lastReceived as "Last Connected" mysourcetype as "Sourcetype" bytes as "Bytes" status as "Status" You could try to convert the Last Connected field to realtime by adding the following pipe to the end of the above search: | convert ctime("Last Connected") Then save that search query as an alert, and see if the email shows in realtime. Be aware this is just a sample query that is unsupported. It is just to give you an idea of some workaround options. Also know that the time reported in the email will not conform to users that are of varying timezones. We suggest you experiment and see what works for you. If you have questions about creating your own queries you can post them on answers.splunk.com. Please let us know if this answers your question. Regards, Splunk Support ... View more

We had quite a frustrating time figuring this out, so here is your answer. More then likely the events your seeing are due to windows registry monitor process running on your windows servers. (verify by looking at task manager for a process named splunk-regmon.exe) Once you see that process your half way home.. Modify your inputs.conf file and the stanza that looks like [WinRegMon://default] disabled = 0 hive = .* proc = .* type = rename|set|delete|create index = windows To... [WinRegMon://default] disabled = 0 hive = .* proc = ^((?!(reg.exe|svchost.exe)).)*$ type = rename|set|delete|create index = windows Reload, run your deployment or the things you typically do.. Then sit back and tell your boss you just saved them many hundreds or thousands of dollars.. Happy Splunking!! ... View more

PS - we use the AD addon but this is just from the event logs. ... View more

Change this: BREAK_ONLY_BEFORE=\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2} To this: BREAK_ONLY_BEFORE=\d{2,4}-\d{2}-\d{2,4}\s+\d{2}:\d{2}:\d{2} ... View more

Did this ever get fixed guys? i am having exactly the same problem with Splunk 6.2.2 Build 255606 SA-nix 5.0.1 Splunk Add-on for *Nix 5.1.2 Im quite a newbie to Splunk so may be making a basic error. Kevin ... View more

How much memory do you have? Any chance to upgrade memory? To be honest - windows 7 is NOT supported so really I would suggest moving this to a supported OS. I am sure they have there reasons for not supporting it. ... View more

Hi, thanks for all your answers Its strange as none of the searches are returning results but the Splunk app for windows infrastructure is returning all of the info I require. Please consider this issue now resolved and thanks again for your assistance. ... View more

Try scheduling this to run periodically (like once every hour): index=* | dedup host | stats count first(_time) AS lastTime by host | eval age=now()-_lastTime | where age>43200 AND age<3600 ... View more

See below post - I built on Raghav thought of getting rid of the tail and using fieldformat substr ... View more

mbarbaro, This question was essentially not actually a problem - the UF restarted from the beginning of the Event Logs and in doing so made it look like it wasn't working any more. When they waited a bit it all ended up fine. If you have a similar problem, I'd suggest compiling together the information about it the creating your own, new question to ask about your specific issue. Happy Splunking, Rich ... View more

This didn't work exactly but it pointed me in the right direction. Thanks! Used |fieldformat day = strftime(day, "%b %d, %Y") dm_license_summary_10m_by_pool | bucket _time as day span=d | eval gb=mb/1024 | stats sum(gb) as gb by pool, day | eval gb=round(gb,2) | fieldformat day = strftime(day, "%b %d, %Y") ... View more

I've been having the same issue since installing Splunk, but I was able to resolve it this morning by enabling Audit file system global object access in the Default Domain Controllers Policy. This is on 2012R2 server running at 2008R2 functional level. Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Global Object Access Auditing > File System Set the Principal to Everyone Set the Type to Success Set Permissions to Create Files / write data Create folders / append data Write Attributes Write extended attributes Delete subfolders and files Delete Change Permissions Take Ownership Hope that helps. ... View more

Glad to see you got what you want 🙂 ... View more

see the docs about timechart tc options http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Timechart#tc_options ... View more

I definitely (now) have the Add-ons in the right path and see them below forwarder management. They are "deployed" to the Windows servers where I should be getting data from yet I am still getting the errors related to Search "sourcetype="ActiveDirectory*" | head 5" and same for sourcetype="MSAD*" | head 5 That is the same on both of the Splunk servers I'm working with (the Add-ons for Windows 2008 domain are in place, and yet we're not getting those events capture for the Windows Infrastructure App. Next suggestion? (And stupid question follow-up... The add-ons were originally kept below the Windows Infrastructure App. I copied them up and into the Deployment-Apps area, as I also did with the Infrastructure App. Should I not have the Infrastructure App there as an App for deployment? Should I have had just the Add-ons? Why don't the add-ons go along for the ride when the Infrastructure App is being deployed??) ... View more

Hi . Did you find solution ? ... View more