Hi  @agadayev, I have the same issue on using app version 2.1.1 on Splunk 7.3.6 (I can't upgrade the application to 3.0.1). I have applied the fix you suggested, but still have this issue.  Any idea about it?  My Splunk runs on Windows 2016. ... View more

I downgraded to the old version and now have to deal with the following error. Anyone know a fix for this error? on version 1.2.4? 2019-10-07 11:44:20,068 INFO pid=5264 tid=MainThread file=setup_util.py:log_info:114 | Customized key can not be found ... View more

Hi I am having the same issue. Were you able to get this search working? Particularly the macro that is not working is called ms_ad_obj_all_changes_base from "MS Windows AD Objects" app. The search is "eventtype=ms_ad_obj_wineventlog_security [|inputlookup AD_Audit_Change_EventCodes | stats values(EventCode) AS EventCode by obj_type | format | table search] src_user_type="user" | search NOT(EventCode=4723 AND src_user!=user)". When ran separately "|inputlookup AD_Audit_Change_EventCodes | stats values(EventCode) AS EventCode by obj_type | format | table search" or "eventtype=ms_ad_obj_wineventlog_security" I get results but when put together I get no results. I have checked macro, file and definition permissions all look intact. Also tried separating everything from each other in the search no luck. Thank you for any help in this. ... View more

We ran into this as well. It looks like Splunk 7 has stricter interpretation of the character class construct, so [\S-\S] means "non-whitespace to non-whitespace" instead of "non-whitespace dash non-whitespace." Ultimately this makes the behavior more predictable. ... View more

Might need to add "edit-scripted" capability to the Role you are doing this with. ... View more

the SEDCMD-remove_ffff is already present and commented in Splunk_TA_windows version 6.0 (but dont change in default file) so you could just : create/update Splunk_TA_Windows/local/props.conf [source::WinEventLog:Security] SEDCMD-remove_ffff = s/::ffff://g [source::WinEventLog:ForwardedEvents] SEDCMD-remove_ffff = s/::ffff://g [WMI:WinEventLog:Security] SEDCMD-remove_ffff = s/::ffff://g ... View more