https://conf.splunk.com/files/2019/slides/FN1190.pdfFN1190.pdf (splunk.com)  ... View more

There are a couple things that need to be performed to Audit Command given in a CLI for Windows: one, follow the below instructions to add Command Line auditing to process execution: We are looking to satisfy the narratives for AU-3(1) and AU-6(8) which specifically talk about capturing full-text of privileged commands. Linux is easy, monitor each user’s .history file. Windows is a little more annoying: https://docs.microsoft.com/en-us/powershell/scripting/windows-powershell/wmf/whats-new/script-logging?view=powershell-7.2 https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-windows-command-line-auditing-february-10-2015-570edc4b-8ee7-950d-4629-045e308743e4 Now to address what if a user uses Powershell instead of widows CMD.   See the following Articles: How to Use PowerShell Transcription Logs in Splunk - Hurricane Labs Solved: How to monitor Powershell Command Line history? - Splunk Community Once you have the data you can search for EventID 4688 for all objects run using administrator Accounts and grab the command line information.   PowerShell is a slightly different beast still but Looking through the data you will find ways to identify Get Commands and Set commands.   Karma is appreciated if this helps ... View more

Glad to hear it bro! ... View more

Did you find what issue caused this or get it resolved?  I have a 14 server system at 2 sites running a multi-site cluster and all my servers upgraded successfully except one of my Search heads. ... View more

I am also having this issue but only one one of 6 splunk servers.  The other Splunk servers do not have a tracker.log.  This log is not listed in: https://docs.splunk.com/Documentation/Splunk/8.2.2/Troubleshooting/Enabledebuglogging#log-local.cfg as a splunk log so I wonder if it has something to be done with the upgrade.   It has been 1 week since my upgrade and this is the only server complaining.  Would really like to know what this log is and why it is having issues.  I checked file permissions and it is the same as the other logs....    This log is in /var/spool/splunk and is a default to be monitored in the /splunk/etc/system/default/inputs.con and is listed as a latency tracker.  of my 6 servers only the search head running ES even has this log in the director y ... View more

Looks like I need to use a powershell script or logparser to do the conversion.  I found some stuff on the internet to help with this for those who may have this issue in the future! Convert evtx Files: Powershell Try: $a = Get-Item *.evtx $output_file = [System.IO.StreamWriter] $("all.csv") foreach($file in $a){     $events = get-winevent -path $file.FullName       foreach ($Event in $events) {         $xml = [xml]($Event.ToXml())           foreach ($s in $xml.Event.System.ChildNodes) {             $output_file.Write($s.Name + ":" + $s.InnerText + ",")         }         foreach ($d in $xml.Event.EventData.Data) {             $text = $d.InnerText             $text = if ($text) { $text.replace("`n","") } else { $text }             $output_file.Write($d.Name + ":" + $text + ",")         }         $output_file.WriteLine()     } }   $output_file.Flush() $output_file.Close()   LogParser: (Download from Microsoft.com) $logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe"$query = "SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx" & $logparser -i:evt -o:csv $query   I have not actually tried this yet, but will be giving it a shot in the near future, I expect some tweaking to the scripting may need to be required. EDIT:  Links for reference: https://serverfault.com/questions/783708/convert-saved-evtx-files-to-text LogParser Download location: https://www.microsoft.com/en-us/download/details.aspx?id=24659   ... View more

I have unzipped the logs already to a directory C:\EventLogs\Restore.  It is literally 50+ evtx files.  The monitor://C:\EventLogs\Restore\* does not appear to be working.  Normally with Windows logs you need to use the wineventlog:// tool, however, it makes a conenction to a channel to monitor the channel.  Since these are not in a channel it will not work.  Since they are evtx files I am not sure the monitor:// can actually read it.  If they were .csv or .log  I am sure monitor:// would work fine.  I was wondering if there is something Splunk has to tackle this challenge.  I really do not want to mount them all manually and convert them to csv files manually.  that would take forever...   EDIT: I cannot be the only person to install splunk and have there customer want to ingest old backed up evtx files.... ... View more

index!=_* returns all data from all indexes except the Splunk system indexes.  Now that you know you have data, try: index!=_* "fail*" AND "password"     ... View more

I figured it out for those curious: | rex field=domain mode=sed "s/\(\d+\)/./g"     ... View more

After modifying apps, I strongly suggest you uninstall and redploy the app. ... View more

try typing: index=*  sourcetype=linux_secure   I think your problem is splunk often wants an index unless you have default index lookups configured in splunk which seeing you are in fundamentals 1, you probably do not.  ig that does not work, try just typeing: index!=_* This should return any data in any index except for splunk specific logs data.  This will tell you for sure you have some data or not.  Also, then see if in the interesting columns under sourcetype, you see the sourcetype you are looking for. ... View more

since I do not have the lab guide, maybe if you post the query you typed in we can see if there is a mistake. ... View more

Even better question, I recently learned python, how do I take what I learned and use it in splunk?  Explanation links to articles are fine answers!  Yes, I give Karma! ... View more

What  if the value being replaced was from DNS Query logs like: (3)windows(12)live(2)com(7) and sometimes (4)live(7)windows(4)update(13)com(4) The goal of course to replace (\d+) with a "." anywhere it appears in the field.    I can easily replace the leading and trailing (\d) using rex to strip them from the field so it looks like: windows(12)live(2)com or live(7)windows(4)update(13)com   how can I then use mode=sed to convert it to windows.live.com and/or live.windows.update.com?  Sometimes the domain name is 10+ word.word.word.owrd in length and it is variable. ... View more

I will try adapting this tomorrow and let you know if I have any issues 😛  Thanks so much for the reply.  If it works I will mark it as a solution as well.  In the meantime, Karma for the starting point 😛 ... View more

yeah, you should not have that inputs.conf in your Splunk/apps/splunkuniversalforwarder directory.  When you redeployed the app to the client, did you uninstall it first, then ensure the restart splunk button was checked?  I would check your clients splunkhome/etc/app/windows_TA/local/inputs.conf and verify it got the updated config, then restart splunk on the client.  Also, i assume yhou ensured the client has an outputs.conf.  if you uninstalled your custom app and it had the outputs.conf then that is why it is not sending logs to the indexer.   ... View more

you need to identify the LAT and LONG.  Ordinarily splunk will perform a whois call and determine the lat/long of the domain the ip is associated with if connected to the internet.  If you want to do this differently, I think you need to apply lat/long yourself.  I do not believe there is an automatic lookup.  there are a couple ways you can accomplish this.  You can build your own lookup table to convert addresses to a lat/long or you can just input the lat/long directly into the data if it is something like a spreadsheet.   For reading about chloropleth maps: https://www.splunk.com/en_us/blog/tips-and-tricks/mapping-with-splunk.html   ... View more

The transforms and props.conf have to be in the same application as the inputs.conf.  Instead of using a custom app, have you tried putting your inputs.conf into the local directory of the Windows_TA?   so in Windows_TA\Local\inputs.conf    This is what the local directory was for.  you can use the windows_TA but only enable the inputs you want, or even modify the settings for the inputs to put them in different indexes.  I would be careful not to mess with the sourcetypes, make sure you leave the defaults as this is how the props.conf and transforms.conf idenitifes what to data to apply the settings to.   I see you have no sourcetypes listed in the above inputs.conf this may be a part of your problem.  Either way, do not use a seperate app for inputs, jsut copy the inputs.conf from the default directory of the windows_TA to the local directory and only enable the features you want. ... View more