arg, the appropriate search to find deleted files is: EventCode=4656 Accesses=DELETE Accesses field was what I was having trouble with.  ... View more

I found that the Windows_TA app had the Security stanza disabled on my indexer. I had it set for forwarder and search head, but the indexer was misconfigured. EventCode=4656 Accessed=DELETE works for me now ... View more

Ha! My indexer had the Security stanza disabled. Enabled the Security Stanza for Windows_TA on the Indexer (have it on forwarder and search head as well) and Access=Delete shows up now for Event ID: 4656 ... View more

I have the same problem and have TA everywhere and using verbose mode The windows event viewer shows ...."Access Request Information: Transaction ID: {00000000-0000-0000-0000-000000000000} Accesses: DELETE SYNCHRONIZE ReadAttributes Access Reasons: DELETE: Granted by D:(A;OICIID;0x1301bf;;;S-1-5-21-4261618638-6163816-2600221728-1136)" But in Splunk all I see is: <Data Name='AccessList'>%%1537 %%1541 %%4423 </Data><Data Name='AccessReason'>%%1537: %%1801 😧(A;OICIID;0x1301bf;;;S-1-5-21-4261618638-6163816-2600221728-1136)   I have many fields being parsed, but I don't even see "Accesss" in the raw data. It seems this is not being parsed correctly but also, Splunk isn't even able to read the data from Windows correctly to include Accesses: DELETE in the raw data ... View more

really? The answer is Chrome isn't supported in Splunk 7.0? ... View more

What about if your pushing the outputs.conf. There is no way to push this if there is an existing outputs.conf file without using /system/local in your deployment. Well, unless you go to all your clients and delete the outputs.conf first, but then I might as well just change it while I'm there. Re-deploy the splunk forwarder with no output.conf and then deploy with a different app. Seems drastic, but I'm suppose that would work. Seems easier to just push /system/local to the client. ... View more

Yet, no other solutions . . . ... View more

same here. ... View more