the answers are totally stupid I never find any relevant response in this community. He is asking about using CIDR for a lookup table that contains ranges.... No splunk documentation about it!!!! Try to improve ur documentation please ... View more

Thanks for your answer! Works great! But I would prefer to get it already in props.conf extracted. So, my users do not have to have the query at hand. I took your approach and came up with the following solution in props.conf: [MSAD:NT6:DNS] EVAL-src_domain_punct = trim(replace(src_domain, "\(\d+\)", "."),".") ... View more

There is already another post and answer to this question: This is a known issue - SPL-58682 - with Splunk monitoring the Current Control Set for this section. The work around is to use the following setting for hive: 1. hive = HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET\ENUM\USBSTOR?.* ... View more

Thank You! It worked as You descibed. The correct query would be: index="wineventlog" source="WinEventLog:Security" TaskCategory="User Account Management" EventCode=4724 [| ldapsearch search="(&(objectclass=user)(!(objectClass=computer))(userAccountControl:1.2.840.113556.1.4.803:=262144))" | fields sAMAccountName | rename sAMAccountName as Account_Name] ... View more

I can confirm - this is the definitely the issue!! Thanks hayduk - I will escalate this as much as I can -ali from Splunk PS ... View more

The suggestion mentioned above did not work for me. I had to do the following: 1) I found it necessary to edit the read-audit-logs_2010_2013.ps1 and the read-mailbox-audit-logs_2010_2013.ps1 scripts with $SessionUri = "http://" + ([System.Net.Dns]::GetHostByName(($env:computerName))).Hostname + "/Powershell/" $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri $SessionUri -Authentication Kerberos Import-PSSession $Session -AllowClobber # Add the remove session to the end of the script Remove-PSSession $Session 2) I could not write to logs nor access various logs, so found it necessary to add the service account running splunk to the Exchange Server Administrators group. 3) Found in the splunkd.log "Get-InboxRule : You must provide a value for this property". Adding a mailbox to the service account fixed this issue. 4) Found in the splunkd.log "Get-MailboxStatistics : Failed to commit the change on object "dbname" because access is denied." Adding the service account to View Only Administrators was not enough. I had to add the service account to Exchange Organization Admins. Now that this is working I will need to pare back some rights as I do not like service accounts with so many permissions in my environment. ... View more