I'm not sure I have enough to go on but here we go. EventID/EventCode 4624 has both the user and IP address for the signature of "An account was successfully logged on". You can run this search to see if you are getting 4624 events. If you are not you need to configure your Domain Controllers Advanced Audit Policy (Don't use Legacy if you can help it) for logon events. A good guide on how to setup Advanced Logging can be found by searching "Windows Logging Cheat Sheet". index=wineventlog "Put the Username here or the IP Address" | fillnull value=unknown | stats count by user,src_ip,EventCode,signature Now if you want to combine events with the Windows DHCP logs you can do something like this. I'm sure there is a better way (lookups) but you get the idea. index=wineventlog "ipaddress of one of your systems" | eval ip=coalesce(src_ip,Source_Address) | join ip type=left [ search index=windows sourcetype=DhcpSrvLog earliest=-2d latest=now() | fields ip,dest_nt_host,nt_host] | fillnull value=unknown | stats count by user,ip,nt_host,dest_nt_host,EventCode,signature Hope this helps ... View more

Thanks for the suggestion, while this produced the results it did not transpose the columns. ... View more

Thank you, that did the trick and saved me a bunch of time. I will add this to my toolbox of SPL. ... View more

It has been a while since I did this but generally speaking I searched all the .conf files for the string Unique_Hosts_Logged_Into_Per_Day and once I found the files I edited the stanza in the .conf file directly. The file was savedsearches.conf in one of the ES apps under etc/apps. e.g. \etc\apps\SplunkEnterpriseSecuritySuite\local\savedsearches.conf Old Stanza [Unique_Hosts_Logged_Into_Per_Day] New Stanza [MyCompany Unique_Hosts_Logged_Into_Per_Day] ... View more

In my case it was my SOC team who had created search in Enterprise Security with the same name. We just renamed the search in Enterprise Security to resolve the issue. ... View more

After removing those lines I get these errors when starting Splunk which is similar to the error the other person got. My setup is single instance for testing so no cluster. Invalid key in stanza [threatlist://minemeld_ipv4threatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 23: description (value: MineMeld IPv4 threatlist indicators for Splunk ES). Invalid key in stanza [threatlist://minemeld_ipv4threatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 26: type (value: threatlist). Invalid key in stanza [threatlist://minemeld_ipv4threatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 27: url (value: lookup://minemeld_ipv4threatlist). Invalid key in stanza [threatlist://minemeld_domainthreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 30: description (value: MineMeld Domain threatlist indicators for Splunk ES). Invalid key in stanza [threatlist://minemeld_domainthreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 33: type (value: threatlist). Invalid key in stanza [threatlist://minemeld_domainthreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 34: url (value: lookup://minemeld_domainthreatlist). Invalid key in stanza [threatlist://minemeld_urlthreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 37: description (value: MineMeld URL threatlist indicators for Splunk ES). Invalid key in stanza [threatlist://minemeld_urlthreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 40: type (value: threatlist). Invalid key in stanza [threatlist://minemeld_urlthreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 41: url (value: lookup://minemeld_urlthreatlist). Invalid key in stanza [threatlist://minemeld_filethreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 44: description (value: MineMeld file threatlist indicators for Splunk ES). Invalid key in stanza [threatlist://minemeld_filethreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 47: type (value: threatlist). Invalid key in stanza [threatlist://minemeld_filethreatlist] in C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\default\inputs.conf, line 48: url (value: lookup://minemeld_filethreatlist). ... View more

I had some extra cycles to troubleshoot this and it looks like my SOC team had created a search in Enterprise Security with the same name a while back. I just renamed the saved search in ES. You can ignore this issue. ... View more

Thanks David this resolved the issue for me and I'm glad it was a simple fix. ... View more

I also have the same problem with both of my indexers having the same error as posted above. I'm wondering if the PSC (Python for Scientific Computing ) needs to be installed on the indexers for this to work. Does this app use the streaming features of the MLTK (Machine Learning Toolkit)? Note: search.log does not contain any errors and only INFO & WARN. The app works fine on my standalone (non-distributed environment) test system. I will install the PSC on my indexers during my next outage window to confirm and post back if David has not confirmed. ... View more

The Failed Logons by IP Address works for us and we are using the Splunk App for Windows Infrastructure V1.4.0, Splunk Enterprise V6.5.1, and Splunk_TA_windows V4.8.3. The only issue we did notice in general with the application was that under Windows Performance Monitoring the Perfmon Hosts Multiselect was not defined correctly so we fixed it (Token Prefix, Token Suffix, and Token Value Prefix were empty) since we are now able to edit the dashboard with 1.4.0. Hope that helps. ... View more

Hmmm. There is a lot going on in this app so I'm not sure where to point you next but I will provide a couple of ideas. Top URL category you said works and the base search is not a macro. sourcetype="pan:traffic" The two panels below start with a basic macro. If you put in just the macro does it return data? Delete everything after the macro to verify. Event Types pan_logs Top Applications pan_traffic If you get data then maybe it is the sourcetype. It's been a while but I thought it might be something to do with _ or :. sourcetype="pan:" sourcetype="pan_" ..... ... View more

My first guess is that since this dashboard is real-time that you can't see the data based on our user permissions. At my company we restrict real-time searches so most of our users of this app would also get a blank dashboard on the Overview. We do allow a few people to have real-time access but it is restricted for performance reasons. How to test Click the search icon on one of the panels This will open in a new window Change the search from real-time to last 15 minutes. If you get data then it is most likely user permissions. ... View more

Thanks worked first try. ... View more

Thank you so much for all the answers you guys are awesome. I have one of them working right now and have tested a couple of the others but was not able to get them fully working yet. I will go through all of them after work. I do like the props and transforms as well but based on two of my tests it did not work yet and I'm probably doing something wrong. I used them in my app on the search head but the fields did not show up and I have not tried to troubleshoot it yet. Once again, thanks!!! ... View more

I had that issue earlier in the year for some of our systems. Solution was to run sfc /scannow and then reboot the given systems. After doing this we were able to install 6.3.3 and newer versions as well. ... View more

We had that issue as well for the .nessus files and our Splunk consultant figured out how to make it work back in 2015. We have since moved away from the .nessus files and instead just use the API which is working well and no longer requires manual intervention. We are using this with Splulnk 6.4.2 and the Splunk Add-on for Nessus 4.0.0. We plan on upgrading to 5.0.0 soon. We configured the Nessus Add-on with two inputs. Maybe you need to configure the nessus_scan in addition to nessus_plugin. nessus_plugin nessus_scan We generated the two keys through the Nessus Pro GUI. We used the same keys for both inputs. Settings, Account, click on the user, selected API Keys and then Generate. Access Key Secret Key I hope this helps. ... View more

Thank you for checking this for us and we will proceed with the installation by disabling our AV during the download and install process. If possible could you reach out to Microsoft? I have submitted a request to Microsoft a few weeks back when you released the application but it seems like they did not take any action. Once again, thanks for the quick reply. ... View more