Hi We have environment where windows events are forwarded => windows Event Collector Windows Event Collector => Splunk indexer Spunk forwarder has been installed only on Collector server. In Splunk host name for all windows events is windows event Collector. How do we make hostname = computer-name is there a way to do this? Thank you in advance. . ... View more

Hi We have a Situation where Reports need to be shared with in certain working group and My question is 1) Can we give a user(LDAP user) some right so that he/she can shared report to his/her own working group without Splunk Admin involving and at the same time this user doesn't have more right than necessary? If yes how could we do this? 2) Can we map a user from LDAP to a splunk Group? I have created a group in splunk and wanted to add AD user to this group so that this particular group can have access to certain reports/apps. Problem I am having is when I double click on user Section where I should be able to assign role is greyed out. Is this what it supposed to be? Note:- Currently I can assign AD(from LDAP) group to local Role but I wanted more granular than this i.e. to be able to select to an AD user not whole group. Is this possible? Thank you ... View more

Hi We are trying to discard some noisy events from a windows server with specific event ID and wanted to do this from index server(not from forwarder). we are not sure if we can use the conditional statement on transforms.conf file? I have following sample file and will appreciate if you could help us I have copied relevant stanza from /default to /local and created two files as below /local/props.conf [wmi] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+---splunk-wmi-end-of-event---\r\n[\r\n]*) CHARSET = UTF-8 TRANSFORMS-wmi=wminull /local/transforms.conf [wminull] REGEX = (?m)ComputerName=(hostname) DEST_KEY = MetaData:Host FORMAT = host::$1 ---where do i put event ID?-------- Thank you ... View more

Hi All I am new to Splunk and having some issue... we have a windows 2008r2 server setup as an event collector for windows servers. Event logs from windows server is being forwarded to this server and goes on to "Forwarded Events" folder. Now I installed universal forwarder on this server with only "Forwarded Events Log" selected. When i go to splunk server, I can't see any events coming. if I install with other option selected(e.g. Application Log), I can see application log of that server appearing on splunk server. I was wondering if i am missing something and will appreciate if some one can guide me. Note:- we have decided not to install splunk agents in every server and not to use wmi as the number of windows we have is lot(in hundreds). Thank you in Advance. ... View more