Edit: After working with Splunk support, this issue is fixed in TA version 8.5.0.   I recently upgraded our Windows TA from 8.0.0 to 8.2.0. I've noticed that with the Event IDs relating to users being removed or added to groups (4728, 4729, 4732) the user removed or added is logged by Windows with their full DN. Splunk before the upgrade was pulling the full DN and extracting it into the user field. Now it seems to not be doing the same. Our DNs contain "Lastname, Firstname" with the log having that first comma escaped.       12/09/2021 00:00:00 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4732 EventType=0 Type=Information ComputerName=domaincontroller TaskCategory=Security Group Management OpCode=Info RecordNumber=1111111111 Keywords=Audit Success Message=A member was added to a security-enabled local group. Subject: Security ID: CONTOSO\user_admin Account Name: user_admin Account Domain: CONTOSO Logon ID: 0xD5D5D5DA Member: Security ID: CONTOSO\FLastname Account Name: CN=Lastname\, Firstname,OU=Users,DC=CONTOSO,DC=com Group: Security ID: CONTOSO\Group_RW Group Name: Group_RW Group Domain: CONTOSO         This is extracted correctly into the Account_Name field, though both the Subject and Member users are placed into Account_Name as an mv field. For some reason, when this same value is extracted into user, it gets extracted only as "Lastname\"   I've done a diff on the default\props and transforms and didn't see any changes to the extractions of this field that I can find, and I had no customization here. I'm at a bit of a loss as to why this would even change. We are using the WinEventLog:Security sourcetype as well. Other extractions seem to be working as intended. ... View more

Did an upgrade from Splunk ES 6.1.1 to 6.6.2 and now any dashboard that uses the Downsampled Line Chart viz fails to load with a "Failed to load source for Downsampled Line Chart visualization. " In fact, any of the visualiztions below the "More" header when selecting a chart type (includes histogram, box plot, 3D scatter plot.) Has anyone run into such an issue after upgrading? ... View more

Noticed that the Azure Addon is pulling the same logs repeatedly, roughly about 12 copies per log. We're using version 3.0.1 of the addon. I did see in another thread "2.0.1 fixes the duplicate alert data issue" but we're still getting it. Haven't upgraded to 3.1.0 as I didn't see any mention in the release notes about this particular issue. Anyone else run into this and found a way to fix it? ... View more