About bobmc859

evinasco · ‎02-12-2020

me too 😕 with CA Identity

danielansell · ‎05-02-2019

Thanks for the response.

bobmc859 · ‎04-03-2019

I've moved the Windows Event log Forwarded Events log to another partition because I expect it to out grow the C partition on our W2K16 machine. In my input conf, before I moved the log I had it set to the following: [WinEventLog://ForwardedEvents] disabled = 0 index = wineventlog Which seem to work fine, however after moving the evtx file I set up the following in my input conf file and it doesn't seem to work as expected [monitor://E:\ForwardedEventsLogs\ForwardedEvents.evtx] sourcetype=WinEventLog:ForwardedEvents index = wineventlog disabled = 0 What I get is garbage like this: ElfFile\x00\x00\x00\x00\x00\x00\x00\x00\x00@!\x00\x00\x00\x00\x00ԏ\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00 Any suggestions on what I'm doing wrong? Thanks!

ragedsparrow · ‎04-03-2019

So, the SplunkUniversalForwarder app holds the configurations that normally define default inputs and settings for a Universal Forwarder. It can be utilized like any other app, though, as you can see here. It doesn't mean that the UF was installed via an app, only that the app named SplunkUniversalForwarder is where the previous person stored their custom configurations. They may also have put their outputs.conf configuration in there as well, so to add the new indexer, you would just need to modify the outputs.conf to include it.

Posts	13
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-02-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Active Directory Ldap failing with Error ".

No data after setting up Add-on for Windows

Monitoring EVTX file on different partition provid...

Syslog data to new Splunk instance

Re: Active Directory Ldap failing with Error ".

Re: No data after setting up Add-on for Windows

Monitoring EVTX file on different partition provid...

Re: Syslog data to new Splunk instance

Join the Conversation