We have already enabled the Splunk logging driver,  but this forwards logs from inside the containers.   I want to capture the docker system-level events, as you would see from this command:     docker events --filter event=stop --since '60m'     https://docs.docker.com/engine/reference/commandline/system_events/   I see this app (not approved for cloud).   Are there any other options? https://splunkbase.splunk.com/app/6113 https://github.com/quzen/docker_analyzer/blob/main/bin/docker_events.py ... View more

We have been using WEF as our collection point for a while.  We started out small but have expanded the range of events over time.   We have ~5,000 hosts forwarding to a single collector. The collector is busy, but seems to be healthy based on conventional Windows indicators. However,  we have some data loss between the centralized event and Splunk (cloud).   Logs show up in the WEF collection log but never make it to the index.   First,   are there any performance tuning suggestions you can offer UF on a WEF collector? Second,  can you think of any way to check on processing of a single event once it goes into the UF and heads to the indexer? ... View more

How do you add fields to a collection? I created my collection via API and filled it with data. Then later on I added some fields to the JSON docs. I also tried POSTing a new field list into the configuration. the collections.conf file still has the original field list, the lookup (based on the KV) shows new data/fields I've added since then the REST API view of the schema has no fields at all: name #text ---- ----- disabled 0 eai:acl eai:appName search eai:userName nobody profilingEnabled false profilingThresholdMs 1000 replicate false replication_dump_maximum_file_size 10240 replication_dump_strategy auto type undefined ... View more

I have a KV collection that uses a CIDR-style network address as the key value. This means that delete operations have to send this forward slash in the URL. I'm getting a 404 "Could not find object". For the key "1.1.1.1/29" I'm using this URL: /servicesNS/nobody/search/storage/collections/data/collectionName/1.1.1.1%2f29 Update operations work fine (because the slash is in the POST data, not the URL?). What (other?) encoding/escaping do I need? On a whim, I tried doubling the forward slashes, but no dice. ... View more

I'm able to pull the events fine with the config below, but the GUIDs aren't being expanded. I've tried evt_resolve_ad_obj = 1 in both props.conf and wmi.conf - no results either way. #inputs.conf [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0 index = eventlog_filtering_test evt_resolve_ad_obj = 1 #wmi.conf [WMI:DC Event Logs] disabled = 0 event_log_file = Security evt_resolve_ad_obj = 1 interval = 5 server = a-dc-01.xyz.dev1 See the event sample here. Note the %{0fab7c44-78be-4a51-aedd-184e673399f3}, which should be an LDAP DN. I think this would work if I pulled the event from a local log (splunk-winevtlog.exe) but not via remote (splunk-wmi.exe). Category=14080 CategoryString=Directory Service Access ComputerName=A-DC-01.xyz.dev1 EventCode=4662 EventIdentifier=4662 EventType=4 Logfile=Security RecordNumber=4882247 SourceName=Microsoft-Windows-Security-Auditing TimeGenerated=20110408172310.201214-000 TimeWritten=20110408172310.201214-000 Type=Audit Success User=NULL wmi_type=WinEventLog:Security Message=An operation was performed on an object. Subject : Security ID: S-1-5-21-2936888650-2301900656-1271333847-1105 Account Name: john.doe Account Domain: XYZ Logon ID: 0x2dfce05 Object: Object Server: DS Object Type: %{bf967a9c-0de6-11d0-a285-00aa003049e2} Object Name: %{0fab7c44-78be-4a51-aedd-184e673399f3} Handle ID: 0x0 Operation: Operation Type: Object Access Accesses: Write Property Access Mask: 0x20 Properties: Write Property {e48d0154-bcf8-11d1-8702-00c04fb96050} {bf967950-0de6-11d0-a285-00aa003049e2} {bf967a9c-0de6-11d0-a285-00aa003049e2} Has anyone gotten this working? Hugh ... View more

I know this question has been asked many times over, but I can't see how my .conf files are different than the working examples. I seem to be getting all EventCodes in my index. Could someone please do a double-check here? # apps/search/local/wmi.conf # [default] [WMI:DC Event Logs] disabled = 0 event_log_file = Security interval = 5 server = a-dc-01 # system/local/props.conf (also tried putting this under search) # [source::WMI:WinEventLog:Security] TRANSFORMS-WMISecurityLog = setWMISecurityLogRetain,setWMISecurityLogNull # system/local/transforms.conf (also tried putting this under search) # [setWMISecurityLogNull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setWMISecurityLogRetain] REGEX = (?m)^EventCode=(4662|5136|5137|5138|5139|5141)\D DEST_KEY = queue FORMAT = indexQueue I'm trying to limit the log entries to the IDs above but I'm getting many more EventCodes than I want. EventCode count(EventCode) --------- ---------------- 4662 44 4735 38 4768 84 4769 2413 4770 79 4771 13 4776 162 5159 1870 Thanks in advance, Hugh ... View more

My authentication and role mapping seem to be working fine, but I see many of these errors in the splunkd log (one for each web login): ERROR ScopedLDAPConnection - Search for DN 'dc=xyz,dc=net' gave error: Operations error Where do they come from? ... View more

I have a UAC-enabled Server 2008 R2 machine with Splunk splunk-4.1.7-95063-x64-release installed. I am using a low-privilege (just the minimum listed in the docs, http://www.splunk.com/base/Documentation/latest/Installation/InstallonWindows#Choosing_the_user_Splunk_should_run_as). This seems fine for splunkd, it can run, open port 8089, and appears to be indexing. The splunkweb service never opens a port and seems to generate these errors every time it starts. Apparently it wants to query the Service Control Manager. When I run the service interactively I get a UAC prompt. Log Name: Security Source: Microsoft-Windows-Security-Auditing Event ID: 4656 Task Category: Other Object Access Events Level: Information Keywords: Audit Failure Description: A handle to an object was requested. Subject: Security ID: xxx\service-splunk Account Name: service-splunk Account Domain: xxx Logon ID: 0x15cb85 Object: Object Server: SC Manager Object Type: SC_MANAGER OBJECT Object Name: ServicesActive Handle ID: 0x0 Process Information: Process ID: 0x204 Process Name: C:\Windows\System32\services.exe Access Request Information: Transaction ID: {00000000-0000-0000-0000-000000000000} Accesses: DELETE READ_CONTROL WRITE_DAC WRITE_OWNER Connect to service controller Create a new service Enumerate services Lock service database for exclusive access Query service database lock state Set last-known-good state of service database Access Reasons: - Access Mask: 0xf003f Privileges Used for Access Check: - Restricted SID Count: 0 ... View more