Wanted to share some good news regarding this issue with the broader community - over the past year we worked with Splunk and Microsoft support and development teams to sort this out. In our organization, 99% of the corrupt events were when Windows was rebooting - a fix for this was identified and successfully tested in our environment. Remaining issue was related to an api error response from EventLog api and a fix for that is in the works per Splunk Dev and support. Both fixes are expected to make it into 9.1 (hopefully around .CONF23). And here's some recommendations that came from the collaborative work with Microsoft. Use 'Delayed Start' for the Splunk Forwarder service. Setup following service dependencies to reduce errors sc config EventLog depend=RpcSs sc config SplunkForwarder depend=EventLog ... View more

Unfortunately, there is no answer to the issue I experienced. Removed my splunk install completely and re-installed the latest version as a fresh install. I only kept my transforms and props.conf files. Everything else is brand new. And the filter is working. I suspect Ayn was on the right track. Something in my configuration was not right. Thanks for the help! ... View more

You could also use the transaction command to some effect, by determining standard start and end points and find any events which do not fit the part. ... View more

Jamesdon, Good luck with this. I don't think you will always see the same error as in the logs... normally the logs would be for a "techie" and the web errors in a more human readable manner (for the general user)... As you probably already know 😛 Regards, MHibbin ... View more

On the latest Splunk versions 6.0+ you will want to have the Splunk_TA_Windows installed on the Forwarder and Indexer/Search Head tiers. This TA will extract the Event Code fields for you from Windows Event Logs. Don't forget to also turn on auditing and domain policies for the specific events you want to collect. Check out the Splunk Blog post about Windows Event Filtering http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/ ... View more

The key is the -K parameter. In my case I used -K ascii /usr/sbin/snort -K ascii -c /etc/snort/snort_eth2.conf -l /var/log/snort_internet -i eth2 ... View more

Thank you very very very much. ... View more

Yes, but you'd have to create such a view yourself. It would actually be a very simple view. I have updated above with an example that would render as a chart, but you could make a similar one with a table, etc. ... View more

Ok here is what I am seeing in the web_service.log 871 ERROR module:59 - Splunkd daemon is not responding: ('[Errno 24] Too many open files',) It appears that there is a limit to open files? Where would I go to modify this limit? thanks ... View more

... a bar chart type entry starting at "start time" and going on until "end time". Maybe I am being too particular. I will give your suggestion a go and it will probably give me good enough results. Again many thanks for your help here. ... View more