What does your props.conf file look like? Are you using KV_MODE = JSON in the darktrace stanza? ... View more

The search that builds the lookup table tHostInfo was disabled in my environment. Enable the scheduled search tHostInfo_Lookup_Update and your dashboard should populate. ... View more

I'm not sure if this is the cleanest way to do this but it works. In the dynamic input field add a rex statement to your search parse out Domain and username into two fields and then concatenate them back together with an extra . |rex field=usernames ""(?[^\]+)\(?.*)" |eval username = domain . "\\" . user |stats count by username This will give you values of the username field with the additional backslash for your escape character. ... View more

You can configure Splunk Enterprise to monitor non-default Windows event logs. Before you can do this, you must import them to the Windows Event Viewer. Once the logs are imported, you can add them to your local copy of inputs.conf To monitor Task Scheduler in Microsoft>Windows>TaskScheduler>Operational, right click on Operational and select properties. Use the "Full Name" to append to WinEventLog:// stanza. In my case, I added the following stanza to inputs.conf [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 index = wineventlog renderXml = false start_from = oldest checkpointInterval = 5 ... View more