The second and third options in my answer may work on Windows, but I have seen or heard of anyone doing so.  "Windows" and "syslog" usually don't go in the same sentence.  Of course, the instructions are usually written for a Linux server so you'll have to translate everything into Windows-speak. This may be a good opportunity to strengthen your Linux skills.  Splunk on Windows can be painful at times. ... View more

So i could load the UF on all of my servers and then just set it to report disk utilization to an index i create in splunk? the UF on every box isnt a concern as long as it doesnt require a lotof resources, having it on all boxes could open a pandoras box of stuff I'd like to do from each server so that might be good 🙂 ... View more

Take a look in Settings - Searches, reports, and alerts. Adjust the owner to yourself and then look in the table below. If you still don't see it, change the app context to All. ... View more

Thank you everybody for your help, i marked the first answer that worked 🙂 Looks nice! ... View more

Yes I agree with the above: Settings > User interface > Views > App context [all] + Owner [your name]. ... View more

The Type of database is SQLlite ... View more

Not really within the scope of the Splunk forums. If it was CentOS 5 I'd say su then issue the command system-config-firewall-tui, but with CentOS 6 running firewalld, it's a different ball game. To be honest I have not yet really configured one. (There are a lot of the CentIOS 6 and 7 changes I really don't like.) For generic Linux admin questions you would be far better off consulting online documentation and support sites. (Linuxquestions.org is a start, although if you start asking questions pretty much anywhere without first having read the documentation you're not going to get a friendly reception.) ... View more

FYI, Fire Brigade version 2 will no longer be updated (latest version is 2.0.3). The newer versions 2.0.4 and higher will now be available with the original “Fire Brigade” app on Splunkbase which was just updated to support Splunk 6.3. This is noted on the page for Fire Brigade on Splunkbase: https://splunkbase.splunk.com/app/1581/ If you have any questions, ping the developer of the app @sowings Cheers! ... View more

it may be that $ is a character that you need to escape... did you try that? ... View more

On 7.1 or newer, you'll need to use the user.seed.conf. Hurricane Labs has a good rundown on how to do it. https://www.hurricanelabs.com/splunk-tutorials/splunk-7-1-performing-a-splunk-password-reset ... View more

I know what server it's coming from I'm trying to find out if it's some default data from the universal forwarder, from the windows infrastructure app, or from the VMware app we have loaded. I dont think it's the vmware app because it splits their sourcetypes into vmware:something... So I think it's either the default or the infrastrcture app. I have suspicions it's the default forwarder actions, but if that's the case why wouldnt every server i have the forwarder on send perfmon data, unless it's because these 2 are my DCs. In any event Im more interested in blocking it. ... View more

You need reset license to clear your warnings and start searching again. Write to splunk and ask for reset license. ... View more

If you are running the Splunk provided .ova file. Then you can run the splunk command from any directory. However make sure you do not type ./splunk, just splunk. e.g. splunk start NOT ./splunk start. If you want to type ./splunk then you must be in the SPLUNKHOME/bin directory. Splunk on the .ova can be found under the home directory of the splunkadmin user. So log in as splunkadmin (DO NOT log in as root). Just type the command ls and you will see an opt directory. Splunk is in that directory. ... View more

anyone have an update on this? if i run the curl -k command I get a curl: (35) SSL connect error. ... View more

Make sure you have a Splunk Universal Forwarder with Splunk_TA_Windows installed on it configured to send windows event logs. Go to the Windows Infrastructure App, then go to Settings and Event Types. You should see something that looks like this screen shot. You'll want to try these searches and see where you have data, for example you can search this: search index=* eventtype=msad-nt5-successful-user-logons OR eventtype=msad-nt6-successful-user-logons Check to see where you have data by searching for these event types, for example start with: search index=* eventtype=wineventlog-security Do you see EventCode as an interesting field? If not then you don't have the right permissions set on the knowledge objects for this app. Look for the eventtype=wineventlog-security definition and make sure that it matches your environment. Save it and try these eventtypes searches again. ... View more