I am using an intermediary server (server 2) to collect forwarded logs from many servers (server 3,4,5,etc) and then I use a Splunk forwarder on there to forward those events to my full splunk instance server (server 1). However, my events are not being forwarded properly. On server 2 they look like this: [ Name] Microsoft-Windows-Security-Auditing [ Guid] {*****************} EventID 4769 Version 0 Level 0 Task 14337 Opcode 0 Keywords 0x6020000000000000 - TimeCreated [ SystemTime] 2015-02-23T14:17:22.10657400Z EventRecordID 705673 Correlation - Execution [ ProcessID] 568 [ ThreadID] 5524 Channel Security Computer **************** Security TargetUserName ********* TargetDomainName ************ ServiceName ********* ServiceSid ********* TicketOptions 0x40810345 TicketEncryptionType 0x13 IpAddress *********** IpPort ******** Status 0x0 LogonGuid {************} TransmittedServices - [ Culture] en-US Message [*long message here*] Task Kerberos Service Ticket Operations Opcode Info Channel Security Provider Microsoft Windows security auditing. Keyword Audit Success But in splunk it just appears as this: 02/23/2015 02:08:40 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4769 EventType=0 Type=Microsoft Windows security auditing. ComputerName=************ TaskCategory=Microsoft Windows security auditing. OpCode=Microsoft Windows security auditing. RecordNumber=705673 Keywords=Microsoft Windows security auditing. Message=Microsoft Windows security auditing. What could be happening in between that is affecting my event details? ... View more

I have created a time range picker in javascript with django bindings and it is rendering fine on the page except that it doesn't update with the preset value i have selected at start. It defaults to "all time" which causes my panels to load very slowly as there is a lot of data on the indexes. var globaltimerange = new TimeRangeView({ id: "global-timerange", preset: "Today", el: $("#globaltimerangeview") }).render(); Has anyone else experienced this? ... View more

I have created a search manager and then a single view using Django tags and javascript. The SingleView element shows us in my splunk app but I only see the text "No search set.". This is the search manager: new SearchManager({ id: "managerID", preview: true, cache: true, status_buckets: 300, search: searchQuery (<--long search query but works fine when searched in the search app) }); This is the singleview: new SingleView({ id: "uniqueID", managerid: "managerID", field: "field1", el: $("#singleview") }).render(); What could be causing this? ... View more