@sachinbansal551 make sure the IP from where you are accessing is whitelisted on port 8089. If the IP is whitelisted you should be able to access the services under https://server_ip:8089 You can check all the services if the IP is whitelisted.   rpc services servicesNS static ... View more

Hi @davidhourani, There is no configuration to ingest Msexchange Management logs in the TA-Exchange-IIS. I already have a configuration to ingest these logs, it is just that the complete information that can be seen in the event viewer is not getting ingested and only the general information in each event is being ingested. Let me know if there is a way( like having a script or a configuration) to ingest the complete information present in an event and not just the general information. ... View more

Hi @davidhourani, There are few additional details being generated on the MSexchange Server but the configuration is not ingesting all of it. It is only ingesting the general details. Is there a way to modify the configuration and have it pick everything being generated on the server. ... View more

Hey mayurr98, The configuration you provided is to index info and debug logs and omit everything else. we want it to be other way. Below are the sample events: Jun XX 10:02:27 3r79-c05-04 hostname : [debug|file|0 ||xcp-rrdd-xenpm] Process 1234 exited normally with XX Jun XX 10:02:27 3r79-c05-04 hostname : [debug|file|0 ||xcp-rrdd-xenpm] Forking command XXXXXXXX Jun XX 11:02:59 3r79-c05-04 hostname: [ info|3R79-C05-04|243325 INET :::43|session.logout 23XXXX|xapi] SessionXXXX XXXXXX The configuration I wrote : props.conf, TRANSFORMS-remove = remove transforms.conf, [remove] REGEX = (^\w+\s+\d+\s+\d+:\d+:\d+\s(3r79-c05-04)\s+[a-zA-z-:]+\s[(debug|\sinfo) DEST_KEY = queue FORMAT = nullQueue it is not working. Anyone please advise. ... View more

@logloganathan are you using any custom alert condition or are you using condition if number of results > 1? Also, have you kept any throttling for the alert and do you want it to trigger it only once or for each result. Let me know. ... View more

The Splunk Version which we are using is 6.6.3.2 ... View more

I Dal, The visualization which is present for the dashboard panel is statistic table visualization. i.e.. Host Age in Seconds Status Hostname1 0.34 Running Hostname 2 1.83 Running Hostname 3 3,57 Running After embedding this panel, I am able to see column chart visualization. I expect the statistic table visualization to come even after embedding. Is there any bug with Splunk version which is not allowing statistical visualization to come? The Splunk Version which we are using is 6.6.3.2 Thanks & Regards, Abhijit Mhatre ... View more

Hi Niket, The visualization which is present for the dashboard panel is statistic table visualization. i.e.. Host Age in Seconds Status Hostname1 0.34 Running Hostname 2 1.83 Running Hostname 3 3,57 Running After embedding this panel, I am able to see column chart visualization. I expect the statistic table visualization to come even after embedding. Is there any bug with Splunk version which is not allowing statistical visualization to come? Thanks & Regards, Abhijit Mhatre ... View more

Hi Hemnaath, You can disable these orphaned searches if they are no longer required. If they are required you can clone them or assign it to any user. ... View more

You can go & check Orphaned Scheduled Searches, Reports, and Alerts dashboard on the deployment server under Dashboards tab. There you can check the Orphaned searches. The orphaned searches error messages would have the same name of the searches which have become orphaned. Please check & let me know. ... View more

It will append the search result of one search with another. ... View more

The event which will occur after an account gets locked out, would be a failed login event. So if user=abc gets locked out, the next event for user=abc would be failed logon. EventCode 4625 would show you failed logon events ... View more

Hi Mihall, If an account gets locked out, the next event coming would be either a failed logon(EventCode4625) or Kerberos pre-authentication failed(4771) event for that particular account. You can use the below query: index=winsec EventCode=4625 OR EventCode=4771 user=abc(locked out user) | eval Time=strftime(_time,"%Y-%m-%d %H:%M:%S") | dedup user ComputerName | eval Error=coalesce(Failure_Reason, Failure_Code)| table Time user Error EventCodeDescription Let me know if this works. Thanks. ... View more

You can add color to health field depending upon the count field values. Try using if condition & mention range for count values in health class & mentioning style=background:red(any color) inside in application.js ... View more

You can add color to health field depending upon the count field values. Try using if condition & mention range for count values in health class & mentioning style=background:red(any color) inside in application.js ... View more

You can add color to field by modifying the count column of your dashboard. You cannot add colors to results of query/alert/report. If you want to add, just go to count column of dashboard & click on brush icon present next to it. After clicking on it, you can add color ranges according to your required values. ... View more