I have several apps I have built in Splunk Enterprise 8.2.5. Each one is in a separate folder under /etc/apps on my search head and each has numerous lookups/macros etc. configured. The problem I have is I wish to combine them all into a single app as they are all used by the same people. The problem is I source control them in Git so I can easily make a change, update Gut and re-deploy the app to the search head. This amounts to it clearing out the app/<app> folder and pulling down the latest version from Git. This works great. Now if I move everything to a single app how can I keep a folder for each 'sub app' for I can keep my Git model? Essentially I want this new app to just have a set of Navigations/Dashboards  ... View more

I'm collecting the System logs from a Windows 2012 R2 DHCP Server using Splunk Universal forwarder 9.0.1.0 to a Splunk Enterprise 8.2.5 indexer. Initially I was collecting all logs using this stanza       [WinEventLog://System] start_from = oldest disabled = 0 current_only = 0       As per the inputs.conf guide here it states that for the allowed key values in an WindowsEvent log monitoring stanza we may use SourceName The source of the entity that generated the event. Corresponds to Source in Event Viewer.   I wished to reduce the number of events collected to only those related to DHCP. When I look into the windows event viewer I see this event for example However, if I search for any event in my indexed data from this server with        SoureName = DHCP-Server       there are no results. A simple query over all time like this shows this       index=windowsdhcp | stats count by SourceName       Howver, in the putput of the stats of all Sourcenames I see this Sourcename namely Microsoft-Windows-DHCP-Server. So I got back to windows event vierwer and look at the XML view of the event which is as follows:       - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="Microsoft-Windows-DHCP-Server" Guid="{6D64F02C-A125-4DAC-9A01-F0555B41CA84}" EventSourceName="DhcpServer" /> <EventID Qualifiers="0">1376</EventID> <Version>0</Version> <Level>3</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-11-21T17:14:28.000000000Z" /> <EventRecordID>1236733</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vmsys305.vhihealthcare.net</Computer> <Security /> </System> - <EventData> <Data>10.119.6.0</Data> <Data>89</Data> <Data>6</Data> </EventData> </Event>       There is no mention of the event with Source=Microsoft-Windows-DHCP-Server. The Providername is the same however. I then press the Copy button which yeilds the following pasted data (to notepad):       Log Name: System Source: Microsoft-Windows-DHCP-Server Date: 21/11/2022 21:13:18 Event ID: 1376 Task Category: None Level: Warning Keywords: Classic User: N/A Computer: vmsys609.vhihealthcare.net Description: IP address range of scope 10.119.6.0 is 89 percent full with only 6 IP addresses available. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-DHCP-Server" Guid="{6D64F02C-A125-4DAC-9A01-F0555B41CA84}" EventSourceName="DhcpServer" /> <EventID Qualifiers="0">1376</EventID> <Version>0</Version> <Level>3</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2022-11-21T21:13:18.000000000Z" /> <EventRecordID>93904</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>vmsys609.vhihealthcare.net</Computer> <Security /> </System> <EventData> <Data>10.119.6.0</Data> <Data>89</Data> <Data>6</Data> </EventData> </Event>       So now we have our SourceName=Source mapping. Summary So this leads me to belive that the sttaement from this guide regarding the SourceName being equivelent to the Source as seen in Windows event viewer requires some clarifcaiton namely that it is as viewed from the output of the copy of the xml view of the event not the default output.   ... View more

I'm running Splunk Enterprise 8.2.5 with deployment server on Windows 2019. I'm deploying the Splunk-Addon for Unix app to my Linux estate. The app runs various .sh shell scripts to capture data and ship back to the indexers. The problem is that these shell script have no execute permission when deployed. I have to run a script at the forwarder to add the execute bit for the Splunk user so that the UF can run them. This is fine as a once off but if we updated the deployment app it occurs again. Is there any way to handle this with Splunk itself?  ... View more

I'm running: Splunk Enterprise 8.2.5 on Windows 2019. 2 indexers in a cluster and a single search head and separate cluster master/license master/deployment server all on windows 2019.  and have installed IT Essentials work version 4.31.1 and created the clustered indexes and enabled the apps I wish to use.  After a few mins the web interface on my single search head grinds to a halt and everything starts running very slowly. Compute on the search head and indexers seems fine and I have 32 cores and 64 GB RAM on each. If I disable all the apps that come with the IT Essentials work package performance returns to normal.  Any ideas on where to look to troubleshoot this?  ... View more

I have some MS IIS 10 instances and I'm ingesting the IIS logs in WSC format from them. I have installed the Splunk Addon For Microsoft IIS  on my search head and both indexers. I set the sourcetype for my inputs to ms:iis:auto. The logs are being ingested but the fields are not being extracted at index time. So, I tried setting the sourcetype to ms:iis:default:85 some fields are extracted but with incorrect filed name. This seems to be due to the fact that the default fields are those for IIS 8.5 and in 10 some are not there by default (s-sitename for example). It seems I would have to tell it what fields I'm using as per Configure field transformations in the Splunk Add-on for Microsoft IIS - Splunk Documentation for the search time extractions to work but not all my IIS servers have the same logging setup. Furthermore, I'd like index time field extraction but that does not seem to work.  This TA is quite old (2020 last update) so I'm wondering is there a better/easier way to do this for IIS 10 ? ... View more