We are currently running Splunk 6.2.3. When our system was installed/configured, the TA-sep version 3.2.1. I recently looked at Splunkbase, and noticed that version 2.0.1 is the most current version. Is it possible that the person who configured our system installed a TA from Enterprise Security? We are not currently using Enterprise Security. If yes, are there differences between that and the version available on Splunkbase? If I want to upgrade to the most current version, would there be any issues if I replace the current TA (3.2.1) with the version from Splunkbase? Thank you. ... View more

I am attempting to restart a universal forwarder which is running on a Windows server. I enter the following: hxxps://server:8089/services/server/control/restart, replacing "server" with the hostname/ip of the server. I am then prompted to enter the admin user/password. After the credentials are accepted, instead of the forwarder restarting, I receive the following: <response> <messages> <msg type="ERROR"> In handler 'server-control': Invalid request, restart requires POST (handler: server-control, action:restart, eai action: list). </msg> </messages> </response> Assistance with this would be greatly appreciated. Thank you. ... View more

I am in the process of deploying Splunk 6.2.3, and am attempting to create LDAP integration and role mapping remotely - on the deployment server. If I look at "Access controls/users" from within the GUI on the Search Head, I see the LDAP users and their assigned roles. I attempted to authenticate, and the error "user="username" has matching LDAP groups with strategy="DSAuth", but none are mapped to Splunk roles." Subsequent to this, if I return to "Access controls/users", my user-id is no longer listed. If I go to "Access controls/Authentication method/LDAP strategies/LDAP Groups", and browse for the LDAP Group Names which contain Splunk users, the "Roles" column is blank. If I manually map the LDAP Group Name to the desired Role, I am then able to authenticate without issue. Any assistance with diagnosing this Role mapping issue would be greatly appreciated. Thank you. ... View more

Is it possible to install the Splunk Add-on for Windows solely on a search head, or must it also be installed on indexers as well? If this is possible, must the search head be running on a Windows platform? Thank you. ... View more

My instance of Splunk was recently upgraded from 6.1.4 to 6.2.0. I have a dashboard which is configured to automatically refresh every 5 minutes. When we were running version 6.1.4 and earlier, the dashboard would refresh properly, leaving the Splunk bar, app bar, etc. in place. Now, however, that is not the case. The dashboard now launches automatically after I authenticate. When it refreshes, I receive a URL similar to the following: https://splunk.local:8000/en-US/app/search/security_events_today?**hideEdit=true&hideTitle=true&hideSplunkBar=true&hideAppBar=true&hideFooter=true&targetTop=true&earliest=0&latest=** Is there a way to configure the dashboard so that when it refreshes, it leaves the values hideEdit=false&hideTitle=false&hideSplunkBar=false&hideFooter=false&targetTop=false? Thank you. ... View more

I created a correlation search in Enterprise Security 2.4.1 which, when triggered, creates notable events with an urgency value of "medium" as opposed to "high". The details of the search follow: Domain: Access Application Context: SA-AccessProtection Search: Group_Name="admin" account_management | get_event_id | eval Group=Group_Domain + "\" + Group_Name | stats first(_raw) as orig_raw,first(event_id) as orig_event,count by signature,ComputerName,Group_Domain,Group_Name Time Range: Start:-5m@m Finish: +5m@m Cron Schedule: */5 * * * * Rule Tile: Account Maintenance Detected - Admin Group $Group_Name$ Rule Description: Maintenance has been performed on the Admin Group $Group_Name$ Severity: high Drill-down Name: View all changes to the group $Group_Name$ Drill-down Search: account_management | search signature=$signature$ Group_Domain=$Group_Domain$ Group_Name=$Group_Name$ ComputerName=$ComputerName$ Window Duration: 5m Fields to Group By: EventCode, signature, ComputerName, Group_Domain, Group_Name Being that the severity specified is "high", shouldn't the notable event also appear with an urgency of "high"? Thank you. ... View more

A few days I upgraded my Splunk servers (Deployment/license server, search head, indexers, heavy forwarder) from version 5.0.5 to 5.0.8. While reviewing the splunkd.log file on one of the indexer servers, I noticed a large number of warnings which state "WinEventLogChannel - connectToDC: DsBind failed: (1722)'No such host is known.'" The indexer appears to be receiving logs properly. Any assistance would be appreciated. Thank you. ... View more

I have somewhere between 20-50 universal forwarders installed on Solaris hosts. I need to change the Splunk admin password on each of these machines, and being that I do not have credentials to logon to each of these hosts, I am curious if this can be done remotely. Thank you. ... View more

I am currently planning an upgrade from Splunk 5.0.5 to 6.0.3. We currently have the Enterprise Security application (2.4.1) installed, and I am curious if it will continue to run without issue on the latest version of Splunk (6.0.3)? Thank you. ... View more

After authenticating to my search head this morning, the message "lookup_expander: One or more column names in the input CSV were invalid" appeared at the top of the browser window. The server is running Splunk 5.0.5 together with version 2.4.1 of the Enterprise Security app. Any assistance with troubleshooting this message would be appreciated. Thank you. ... View more

I am currently planning an upgrade of our Splunk distributed infrastructure and am looking for some guidance. We currently have 1 license/deployment server, 1 search head which is also running the Enterprise Security app, 2 indexers, and 1 heavy forwarder. The version of Splunk is 5.0.5 and the version of the Enterprise Security app is 2.4.1. The documentation mentions the need to test the currently installed apps before upgrading the live system(s). We do not have a test environment, so I am apprehensive. Is the upgrade from 5.0.5 to 6.0.2 straightforward? Do individuals commonly experience problems when upgrading? The documentation made upgrading the Enterprise Security app seem complex. Is that really the case? Lastly, I am curious about backups. Our indexes reside on external storage. Does it suffice just to backup the Splunk directory structure before upgrading? Is the indexed data affected in any way by the upgrade? Thank you. ... View more

We are currently running Splunk 5.0.5 together with Enterprise Security 2.4.1. A weekly Nessus scan runs which triggers the "Brute Force Access Behavior Detected" correlation search when specific authentication attempts are made against Windows hosts. I am interested in tweaking this search so not to run during the time that the scan is running (Friday afternoon between 1600 - 1700). I added the statement "NOT (earliest=@w5+16h latest=@w5+17h)" to the search, but the same alerts (incidents) were triggered during the time when the scan was running which indicated to me that the statement did not prevent the search from running. If there is a different/better way to do this, please let me know. Thank you. ... View more

We are currently running Splunk 5.0.5 together with Splunk Enterprise Security 2.4.1. The Cisco Firewalls (TA-cisco v2.0) app is currently installed. Being that the Add-on for Cisco ASA (3.0) maps firewall data to the CIM, I am considering installing that in place of the TA-cisco 2.0 app. I am curious if there might be any drawbacks in doing this? Is the upgrade just a question of removing the first app. and then installing the second? Thank you. ... View more

I am interested in creating a report which shows Enterprise Security Incidents which were updated during a specific time period. It appears that the Enterprise Security app writes incident information to a lookup table. The time of each update is stored in this table with the fieldname "_time". When searching for "_time", I am not sure how to differentiate between the Splunk "_time" value and the variable stored in this lookup table. ... View more