Yup -- that caused it to return results. However, now how do I change it so that it doesn't timeout on the larger query? Is the timeout something on the app side or is that on the domain controller side? It's strange because it used to run for ~hour without timing out and would return the tens of thousands of users I need it to but now it seems to just time out. ... View more

This does the same thing as just objectClass unfortunately 😞 ... View more

This is actually incorrect. Removing change_own_password does not prevent the user from changing their timezone. ... View more

That's an interesting nuance with your Windows Event Logs, thanks for sharing the fix! ... View more

Is the forwarder sending straight to the indexer tier or is it going to a heavy forwarder? ... View more

I am guessing /var/log/secure are linux secure -- did you happen to install the TA? My best guess is that there's a transforms/props file on the searchhead that is causing the host name to be re-written depending on the content of the message. Do you notice a pattern of which ones say mymachine versus the others? ... View more

you are sending this over TCP right and not UDP? The fact that it chops it off at 2 lines to me doesn't look like a truncation issue on the props and transforms but more like the data is getting split into small segments like a UDP connection would do for Windows events. ... View more

Interesting, the only true way you could check this is if you have a network monitoring application installed that would allow you to see outbound and inbound from the splunk box. The other option which may or may not work is you should see CPU increase when compression is turned on versus off -- depending on how many logs you are getting that it needs to compress the average CPU should increase by 1-2%. If you have SOS installed and sending to the indexers or the DMC enabled for this box you could actually just monitor between the two settings for a few minutes and check to see if the CPU jumps up a bit above where it is when compressed is commented out. ... View more

This is because of the dreaded period. Do this: index = myindex | rename clientRequest.uri as uri | |rename edgeRequest.httpMethod AS "edgeRequest_httpMethod" |eval uri= if(edgeRequest_httpMethod==POST,"value1","value2") | stats count by uri ... View more

Unfortunately i have retracted my answer, it doesn't look like it is possible. I am trying to get it to work on my own side first. ... View more

What does the source of the log say? is it a gz file? I am wondering if the compressed=true isn't necessary, I have noticed that with non-Splunk compressed (but they are GZ files) files will automatically get uncompressed at index. EDIT: After searching it looks like if you have SSL enabled, compression is turned on by default - meaning that the compressed flag does nothing. EDIT2: Have you checked to make sure that the outputs.conf is the correct one? Have you checked using btool? ... View more

Do you have any other CMAs/CLMs? ... View more

What's your outputs.conf? Is the data in your main index? ... View more

If you restart splunkd while running a tcp dump, you see zero packets reaching out to the server? It just seems strange because according to your logs: [ 9348 4149401280]@tropicalia[21 Mar 13:15:48] opsec_auth_client_connected: connect failed (301) [ 9348 4149401280]@tropicalia[21 Mar 13:15:48] opsec_auth_client_connected: SIC Error for lea: ckpSSL ssl lib error [ 9348 4149401280]@tropicalia[21 Mar 13:15:48] opsec_auth_client_connected:conn=(nil) opaque=0x9ffc838 err=0 comm=0x9fe7e40 [ 9348 4149401280]@tropicalia[21 Mar 13:15:48] comm failed to connect 0x9fe7e40 [ 9348 4149401280]@tropicalia[21 Mar 13:15:48] OPSEC_SET_ERRNO: err = 8 Comm is not connected/Unable to connect (pre = 0) It thinks it is connecting out and attempting to reach them. Can you try starting a tcpdump on one session, double check the port and dump query and then in a second session run a splunkd restart? ... View more

Based on your logs it is trying to connect to the Opsec server but the connection gets refused. If you're able to pull the cert then my current best guess is that the Entity SIC Name is wrong -- some CP Admins make the FWs have custom names. For example, they might've named it TropicalLA or something also this is case sensitive keep in mind. ... View more

It might be messy but you could create another input that loads based on the radio button that sets its variable to the REGEX that you would want to run, then, you pass that input's variable into the regex pipe. For example base search | if STATUS==$token_radiobutton$,regex1,regex2 | table extracted fields from regex Set the input's token value to the field STATUS Then on the dashboard base search | regex $STATUS_TOK$ | ... View more

Looking through the TA's Props.conf and transforms.conf now and those fields do have their regex written for them. You installed the Splunk_TA_windows on the search heads? -- Presumably, I'd rather get the TA fixed than have a custom REGEX that only solves one field over all of the fields. Do you have any custom parsers written at the private, app or global level for Windows events? That would be the #1 reason why the TA no longer parses the data. ... View more

Do you not have the Windows TA installed? What event code are you seeing this? In my experience the TA extracts each account name as different (Src and Dest user) so I am not sure where/why you wouldn't be seeing such a case if the TA is installed. ... View more