Hi, you can use first search as sub search to the second search. Something like that : index=wineventlog sourcetype="WinEventLog:Security" Account_Name!="*$" AND Account_Name!=SYSTEM AND EventCode=4624 [search index=x "Login succeeded" | rex "]\sGDI\(?[^(]+)"|stats count by user|fields - count|format] |table * ... View more

I've ended up using JMS modular input 1.5.1 No errors.All messages are taken on schedule Best regards ... View more

Hello , After changing jars in \jms_ta\bin\lib folder for this list : "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\jmsmodinput.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\splunk_tlsv12.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\jms.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\log4j-1.2.16.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-web-5.15.4.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-console-5.15.4.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-spring-5.15.4.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-kahadb-store-5.15.4.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-broker-5.15.4.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-jaas-5.15.4.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-openwire-legacy-5.15.4.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-client-5.15.4.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\activemq-protobuf-1.1.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\jcl-over-slf4j-1.7.25.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\slf4j-api-1.7.25.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\slf4j-log4j12-1.7.25.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\geronimo-jta_1.0.1B_spec-1.0.1.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\geronimo-j2ee-management_1.1_spec-1.0.1.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\geronimo-jms_1.1_spec-1.1.1.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\hawtbuf-1.11.jar" "C:\Program Files\Splunk\etc\apps\jms_ta\bin\lib\splunk.jar" I was able to get rid of the error . However I still having problems : Messages are taken only during restart or when I disable/enable the input. And following error is thrown : ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\jms_ta\bin\jms.py"" It has been determined via the REST API that all inputs have been disabled ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\jms_ta\bin\jms.py"" Can't connect to Splunk REST API with the token [Splunk kCmdvKWBwD3pb5A7wfxaWZfqiFVTUl7AyDnrmLRHjbfzvwDueqNXjG6mfJIXLOual5usKoz0yDGwhze5Sw0^^n6vEYSOOCz0FMhnPmdhjDct8vMUBo], either the token is invalid or SplunkD has exited : No appropriate protocol (protocol is disabled or cipher suites are inappropriate) ... View more

Hi Damien , I'm using Splunk 7.1.2 with default ssl settings : web.conf [settings] enableSplunkWebSSL = 1 servers.conf [general] serverName = AAAAAAAA pass4SymmKey = BBBBBB [sslConfig] sslPassword = CCCCCCCC [lmpool:auto_generated_pool_download-trial] description = auto_generated_pool_download-trial quota = MAX slaves = * stack_id = download-trial [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder quota = MAX slaves = * stack_id = forwarder [lmpool:auto_generated_pool_free] description = auto_generated_pool_free quota = MAX slaves = * stack_id = free [lmpool:auto_generated_pool_enterprise] description = auto_generated_pool_enterprise quota = MAX slaves = * stack_id = enterprise [license] active_group = Enterprise [sslConfig] enableSplunkdSSL = true useClientSSLCompression = true useSplunkdClientSSLCompression = true enableSplunkSearchSSL has been moved to web.conf/[settings]/enableSplunkWebSSL ... View more

Hello, CA not exactly supports installing universal forwarder on their appliance. But it always possible to set a syslog on CA API Gateway and point it to Heavy Forwarder or Indexer - depending on your configuration. Syslog is set by using Log Sink Properties :setting type as syslog and setting splunk host:port in syslog settings. Important : You have to set at least one category - Audit ,for example and at least one additional filter - for example Service Name . Splunk setting are pretty standard - TCP Data input (UDP is also supported by Layer 7 ) ,port (for example 514) ,source type(syslog or any proper source type) host and index. ... View more

Did you tried NVD3 charts http://nvd3.org/ ? Starting from Splunk 6.0 you can build your own visualization using Web Framework Toolkit application. ... View more

Hi jcoates_splunk, Thank you for your help. Most of the events are shown,but I do have a question. I still don't see any events on Security Posture and Event Investigators. Does it mean that it need some more work to do ? ... View more

Stats is works too,but I'm interested to see count (statistics) for each browser in one search grouped by browser. See "picture" ||| || ||| ||||| IE Firefox Opera Each group of || is count of versions for each browser. I hope that I was able to explain myself. ... View more

Hello Damien, and thank you for an answer. I understand the point ,but what if I can't consume message ,I need only browse existing messages. If I understand right this is what you mean when you use dequeue ? When I change frequency to higher value,I see the same issue,but much slowly. There are plenty of tools for browse (HermesJMS for example) but I would like to offer to our client to use Splunk for JMS too. Regards, Dmitry ... View more