I have to define some new indexes on production indexers (in the indexes.conf). I have 4 indexers running. Someone else setup an app to send_data_to_indexers (a basic outputs.conf) as follows [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = splunkindexer1.mycorp.com:9997, splunkindexer2.mycorp.com:9997, splunkindexer3.mycorp.com:9997, splunkindexer4.mycorp.com:9997 [tcpout-server://splunkindexer1.mycorp.com:9997] My question is: If this outputs.conf is being used for all data being sent to the indexers, then can I edit the indexes.conf on each indexer and then restart one at a time? Or is there a better way to do this? Thank you ... View more

I have successfully installed sysmon and verified the schemaversion matches the schemaversion in the config file (sysmonconfig-export.xml by SwiftonSecurity). I have confirmed that sysmon is running in event viewer (Application and Service Logs > Microsoft > Windows > Sysmon > Operational). I downloaded and installed the TA-microsoft-sysmon on the search head I use. I also copied the TA-sysmon folder to the deployment server (\Splunk\etc\deployment-apps\TA-microsoft-sysmon) and then deployed it to my UF running on my test host. I ran my handy query |tstats values(sourcetype) WHERE index=* by index and noticed the data was rolling into the default main index... How do I change the index to winsysmon ? or does anyone have a better idea which index the sysmon data should go in? Thank you ... View more

So while I was out, some Windows config changes were pushed to some Windows servers that had fully deployed UFs with deployed-apps. Prior to these windows changes, the servers were sending wineventlogs via UFs to the indexers without issue. Now the UFs are phoning home but I am not able to see any data since the time the windows changes took place. In fact, since the changes the indexes do not show when I run the following search AFTER the time of the changes, |tstats values(sourcetype) WHERE index=* by index The indexes do show up when I run the search BEFORE the time changes were made, which makes sense. It appears all windows related indexes are down, any advice on where to start troubleshooting? Thank you ... View more

When I add clients to the deployment server - server class tab for example Server Class > windows_wkstns > edit > edit clients include(whitelist) I get the following options: Can be client name, host name, IP address, or DNS name Is it advisable to add only one name or host name, DNS name, and client name? Will adding all 3 vs just 1 result in more comprehensive / complete log collection? Also how do you delete a client from the include list when you only have 1 client listed? I am testing different endpoints one at a time right now. Thank you ... View more

I am test deploying UFs to collect windows event logs from Windows 10 endpoints. I have installed the UF on Windows and entered the Deployment Server info during install. I am using the DS to push out two deployment apps to the UF. 1st is a custom app to push to all indexers, could the following be improved? [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = splunkindexer1.mycorp.com:9997, splunkindexer2.mycorp.com:9997, splunkindexer3.mycorp.com:9997, splunkindexer4.mycorp.com:9997 [tcpout-server://splunkindexer1.mycorp.com:9997] The other deployment app I want to use is Splunk_TA_Windows which is currently being used to collect DC winevent logs without an issue. # Copyright (C) 2005-2015 Splunk Inc. All Rights Reserved. # DO NOT EDIT THIS FILE! # Please make all changes to files in $SPLUNK_HOME/etc/apps/Splunk_TA_windows/local. # To make changes, copy the section/stanza you want to change from $SPLUNK_HOME/etc/apps/Splunk_TA_windows/default # into ../local and edit there. # [default] evt_dc_name = evt_dns_name = ###### OS Logs ###### [WinEventLog://Application] disabled = false start_from = oldest current_only = 0 checkpointInterval = 5 index = wineventlog renderXml=false [WinEventLog://Security] disabled = false start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)" index = wineventlog renderXml=false [WinEventLog://System] disabled = false start_from = oldest current_only = 0 checkpointInterval = 5 index = wineventlog renderXml=false ####### OS Logs (Splunk 5.x only) ###### # If you are running Splunk 5.x remove the above OS log stanzas and uncomment these three. #[WinEventLog:Application] #disabled = 1 #start_from = oldest #current_only = 0 #checkpointInterval = 5 #index = wineventlog # #[WinEventLog:Security] #disabled = 1 #start_from = oldest #current_only = 0 #evt_resolve_ad_obj = 1 #checkpointInterval = 5 #index = wineventlog # #[WinEventLog:System] #disabled = 1 #start_from = oldest #current_only = 0 #checkpointInterval = 5 #index = wineventlog ###### IIS ###### #[monitor://D:\inetpub\logs\LogFiles] #sourcetype=iis #disabled = 1 ###### DHCP ###### [monitor://$WINDIR\System32\DHCP] disabled = 0 whitelist = DhcpSrvLog* crcSalt = <SOURCE> sourcetype = DhcpSrvLog index = windows ###### Windows Update Log ###### [monitor://$WINDIR\WindowsUpdate.log] disabled = 1 sourcetype = WindowsUpdateLog index = windows ###### Scripted Input (See also wmi.conf) [script://.\bin\win_listening_ports.bat] disabled = 1 ## Run once per hour interval = 3600 sourcetype = Script:ListeningPorts index = windows [script://.\bin\win_installed_apps.bat] disabled = 1 ## Run once per day interval = 86400 sourcetype = Script:InstalledApps index = windows ###### Host monitoring ###### [WinHostMon://Computer] interval = 600 disabled = 1 type = Computer index = windows [WinHostMon://Process] interval = 600 disabled = 1 type = Process index = windows [WinHostMon://Processor] interval = 600 disabled = 1 type = Processor index = windows [WinHostMon://Application] interval = 600 disabled = 1 type = Application index = windows [WinHostMon://NetworkAdapter] interval = 600 disabled = 1 type = NetworkAdapter index = windows [WinHostMon://Service] interval = 600 disabled = 1 type = Service index = windows [WinHostMon://OperatingSystem] interval = 600 disabled = 1 type = OperatingSystem index = windows [WinHostMon://Disk] interval = 600 disabled = 1 type = Disk index = windows [WinHostMon://Driver] interval = 600 disabled = 1 type = Driver index = windows [WinHostMon://Roles] interval = 600 disabled = 1 type = Roles index = windows ###### Print monitoring ###### [WinPrintMon://printer] type = printer interval = 600 baseline = 1 disabled = 1 index = windows [WinPrintMon://driver] type = driver interval = 600 baseline = 1 disabled = 1 index = windows [WinPrintMon://port] type = port interval = 600 baseline = 1 disabled = 1 index = windows ###### Network monitoring ###### [WinNetMon://inbound] direction = inbound disabled = 1 index = windows [WinNetMon://outbound] direction = outbound disabled = 1 index = windows ###### Splunk 5.0+ Performance Counters ###### ## CPU [perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = 1 instances = * interval = 10 object = Processor useEnglishOnly=true index = perfmon ## Logical Disk [perfmon://LogicalDisk] counters = % Free Space; Free Megabytes; Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time; Avg. Disk Read Queue Length; % Disk Write Time; Avg. Disk Write Queue Length; Avg. Disk sec/Transfer; Avg. Disk sec/Read; Avg. Disk sec/Write; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec; Disk Bytes/sec; Disk Read Bytes/sec; Disk Write Bytes/sec; Avg. Disk Bytes/Transfer; Avg. Disk Bytes/Read; Avg. Disk Bytes/Write; % Idle Time; Split IO/Sec disabled = 1 instances = * interval = 10 object = LogicalDisk useEnglishOnly=true index = perfmon ## Physical Disk [perfmon://PhysicalDisk] counters = Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time; Avg. Disk Read Queue Length; % Disk Write Time; Avg. Disk Write Queue Length; Avg. Disk sec/Transfer; Avg. Disk sec/Read; Avg. Disk sec/Write; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec; Disk Bytes/sec; Disk Read Bytes/sec; Disk Write Bytes/sec; Avg. Disk Bytes/Transfer; Avg. Disk Bytes/Read; Avg. Disk Bytes/Write; % Idle Time; Split IO/Sec disabled = 1 instances = * interval = 10 object = PhysicalDisk useEnglishOnly=true index = perfmon ## Memory [perfmon://Memory] counters = Page Faults/sec; Available Bytes; Committed Bytes; Commit Limit; Write Copies/sec; Transition Faults/sec; Cache Faults/sec; Demand Zero Faults/sec; Pages/sec; Pages Input/sec; Page Reads/sec; Pages Output/sec; Pool Paged Bytes; Pool Nonpaged Bytes; Page Writes/sec; Pool Paged Allocs; Pool Nonpaged Allocs; Free System Page Table Entries; Cache Bytes; Cache Bytes Peak; Pool Paged Resident Bytes; System Code Total Bytes; System Code Resident Bytes; System Driver Total Bytes; System Driver Resident Bytes; System Cache Resident Bytes; % Committed Bytes In Use; Available KBytes; Available MBytes; Transition Pages RePurposed/sec; Free & Zero Page List Bytes; Modified Page List Bytes; Standby Cache Reserve Bytes; Standby Cache Normal Priority Bytes; Standby Cache Core Bytes; Long-Term Average Standby Cache Lifetime (s) disabled = 1 interval = 10 object = Memory useEnglishOnly=true index = perfmon ## Network [perfmon://Network] counters = Bytes Total/sec; Packets/sec; Packets Received/sec; Packets Sent/sec; Current Bandwidth; Bytes Received/sec; Packets Received Unicast/sec; Packets Received Non-Unicast/sec; Packets Received Discarded; Packets Received Errors; Packets Received Unknown; Bytes Sent/sec; Packets Sent Unicast/sec; Packets Sent Non-Unicast/sec; Packets Outbound Discarded; Packets Outbound Errors; Output Queue Length; Offloaded Connections; TCP Active RSC Connections; TCP RSC Coalesced Packets/sec; TCP RSC Exceptions/sec; TCP RSC Average Packet Size disabled = 1 instances = * interval = 10 object = Network Interface useEnglishOnly=true index = perfmon ## Process [perfmon://Process] counters = % Processor Time; % User Time; % Privileged Time; Virtual Bytes Peak; Virtual Bytes; Page Faults/sec; Working Set Peak; Working Set; Page File Bytes Peak; Page File Bytes; Private Bytes; Thread Count; Priority Base; Elapsed Time; ID Process; Creating Process ID; Pool Paged Bytes; Pool Nonpaged Bytes; Handle Count; IO Read Operations/sec; IO Write Operations/sec; IO Data Operations/sec; IO Other Operations/sec; IO Read Bytes/sec; IO Write Bytes/sec; IO Data Bytes/sec; IO Other Bytes/sec; Working Set - Private disabled = 1 instances = * interval = 10 object = Process useEnglishOnly=true index = perfmon ## System [perfmon://System] counters = File Read Operations/sec; File Write Operations/sec; File Control Operations/sec; File Read Bytes/sec; File Write Bytes/sec; File Control Bytes/sec; Context Switches/sec; System Calls/sec; File Data Operations/sec; System Up Time; Processor Queue Length; Processes; Threads; Alignment Fixups/sec; Exception Dispatches/sec; Floating Emulations/sec; % Registry Quota In Use disabled = 1 instances = * interval = 10 object = System useEnglishOnly=true index = perfmon [admon://default] disabled = 1 monitorSubtree = 1 [WinRegMon://default] disabled = 1 hive = .* proc = .* type = rename|set|delete|create index = windows [WinRegMon://hkcu_run] disabled = 1 hive = \\REGISTRY\\USER\\.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\.* proc = .* type = set|create|delete|rename index = windows [WinRegMon://hklm_run] disabled = 1 hive = \\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\.* proc = .* type = set|create|delete|rename index = windows The problem I noticed is that security events were delayed as I monitored the events from a test endpoint. I am not sure if that is normal at start up. Can anyone provide guidance on building/modifying the inputs.conf for window event collection from endpoints or point to a good reference? Also does any one have tips on how they separated the winevent logs into different indexes??? I am thinking about separating winevents from different servers e.g. DC, DHCP, DNS, Web and endpoints by index. But I would like to learn if anyone has a different method or solution to keep events organized. Thank you ... View more