Do you find any issues in the metrics logs? Please look for any WARN | ERROR level messages in the metrics.log. There might be some blocked queues preventing forwarding of data. You can find the blocked queues using below grep pattern on metrics.log tail -f $SPLUNK_HOME/var/log/splunk/metrics.log | grep "blocked=true" If you find any queues blocked, we need a fix there. ... View more

Based on your inputs, I am putting few ways where it might have gone wrong. There is no data in D:\Syslog\ASA. But as you said, there is data. Check the user splunk running with, does he have permission to access D:\Syslog\ASA On indexer, there is no index created with the name cisco_asa. In such case, the indexer will throw warnings that there is data coming for this index which in not present. The most common mistake, the data is perfectly indexed in index=cisco_asa but, the User Role you are logged in with does not have 'cisco_asa' index added to searchable list. Using Admin user, Please visit Settings >>> access control >>> [your user role] >>> check the list of indexes allowed to be searched for your role. Above are some causes that make some indexed data not searchable. Please do a check and revert. ... View more

If not just 'a dashboard' but 'all the screens of Splunk' are refreshing frequently, the first possibility is because of the SAML / SSO authentication. Please connect with your SAML provider team to check if your SSO is trying to refresh tokens frequently in your browser. If it's only on the dashboard and not anywhere in Splunk, it is happening because of the refresh interval in the dashboard XML. ... View more

Your question is unclear. can you elaborate a little more? ... View more

Can you please mention some more details, such as the file type, contents of the file and what is the issue you are facing. Splunk does not face any problem with unstructured data. The only requirement is your data should be in ASCII format. Splunk does not worry about whether the data is structured or not, it just needs to be in ASCII format. There are some possibilities, Either the data is not a text file / ASCII data. The data is indexed but you are not able to search them. You are able to search the data but the fields are not extracted. Please write details about your issue and we can help to fix them. ... View more

index=<someIndexName> sourcetype="<someSourceType>" <SomeField>=* | table eventType, sender, headerFrom, recipient{}, toAddresses{}, subject, imposterScore, GUID, messageTime, phishScore, spamScore, quarantineFolder, senderIP, messageID, threatsInfoMap{}.classification, threatsInfoMap{}.threatUrl, threatsInfoMap{}.threatID, threatsInfoMap{}.campaignID, threatsInfoMap{}.threat, threatsInfoMap{}.threatStatus, threatsInfoMap{}.threatTime, threatsInfoMap{}.threatType ... View more

Yes, I know that, but for similar scheduled search, for some other query, I receive alert for every event. I mean, it has a different query but similar schedule of 15 mins. If there are 10 events, I receive 10 emails. Here, it send only 1 email for everything. ... View more

I found the cause, your URL redirects to something https://www.baboonbones.comblog/get-binary-data-splunk/, which is not a valid, So i added '/' after the .com and before the blog. and here I found it. ... View more

The URL you provided, is not opening, can you please repost the same? ... View more

Waiting for an answer. I feel this might be a bug. ... View more

I also had the same issue. I tried setting up timestamp configuration myself but i messed something. Later found that there was slight mistake in the Regex for TIME_PREFIX. I used your suggestion and now I am perfect. Thanks. Upvoted. ... View more

Welcome. Thanks for selecting as solution. Happy Splunking! ... View more

The Cisco Networks Add-on (TA-cisco_ios) does not need any special configuration setup. You only need to set the correct source types i.e. cisco:ios for networking devices, such as routers and switches and WLC. The Cisco Networks App for Splunk Enterprise also does not require much of setup. The Cisco Networks App for Splunk Enterprise comes with few pre-built dashboards and reports. You only need to make sure the data is indexed correctly with the correct source type and the user has correct permissions. I am noting a few points that you can check : The source type for the input is correct. If you are using any custom index other than main, does the user has access to that index? You can go to Settings>> Access Controls >> Roles >> 'select role' >> Indexes searched by default. Please make sure, the searches behind the dashboard are producing results. Make sure that data is received and indexed in splunk by doing a search on the sourcetype. Hope this Helps. ... View more

I am not very sure what you are expecting in the answer. I suppose you want to monitor the enlisted events. Windows OS, log every event with an Event ID associated with it. So every activity on the Windows has an Event ID assigned and the same is stored along with the details of the event. Below I am providing a list of event IDs associated with every event in windows. You can get help from that. Event ID and Respective Event 4616 The system time was changed. 4624 An account was successfully logged on 4625 An account failed to log on 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4662 An operation was performed on an object 4670 Permissions on an object were changed 4672 Special privileges assigned to new logon 4688 A new process has been created 4689 A process has exited 4702 A scheduled task was updated 4719 System audit policy was changed 4720 A user account was created 4722 A user account was enabled 4723 An attempt was made to change an account's password 4724 An attempt was made to reset an accounts password 4725 A user account was disabled 4726 A user account was deleted 4727 A security-enabled global group was created 4731 A security-enabled local group was created 4732 A member was added to a security-enabled local group 4733 A member was removed from a security-enabled local group 4735 A security-enabled local group was changed 4738 A user account was changed 4768 A Kerberos authentication ticket (TGT) was requested 4769 A Kerberos service ticket was requested 4770 A Kerberos service ticket was renewed 4771 Kerberos pre-authentication failed 4776 The domain controller attempted to validate the credentials for an account 4779 A session was disconnected from a Window Station 4904 An attempt was made to register a security event source 4905 An attempt was made to unregister a security event source 5058 Key file operation 5061 Cryptographic operation 5136 A directory service object was modified Hope this help. Please elaborate your exact question so that I can answer. ... View more

It is completely fine if you install Syslog-ng on your Heavy Forwarder. There are advantages to this. I am enlisting a few points below please consider them Heavy Forwarders need higher resources as compared to Universal Forwarders. Please make sure you have enough resources. As with Heavy Forwarder, you might not be indexing all the data that is received. A plain HF with no indexing requires less storage. But when we switch to Syslog-ng, the storage requirements increase based on the amount of data we ingest. We need to take care of the log rotation, in case we have a huge volume of data coming to the Syslog server. If the disk gets full, Syslog server might stop working and we lose in-flight data. Old and Indexed data should be removed / archived on time. Using Syslog server, it is more convenient to manage data before indexing it in Splunk. Hope the above points are helpful. ... View more

Please let me know if this worked. If my answer was helpful, please accept this as a solution. ... View more

There are various reasons behind dashboards not displaying data. Dashboards do not pull any data, but there are splunk searches running behind every panel in the dashboard. The panel will not display any data if the relevant search behind that panel is not finding any results. Following are some cases you can check for the troubleshooting this 1. Check if the Dashboard and Panel has appropriate user permissions. If you do not have access permissions to dashboards or apps that contain the dashboard you may not be able to see it. 2. If you can edit the dashboard panels, try to see the searches running behind each panel. In most cases the searches fail to create any results for the dashboard and dashboard fails to display data. You need to troubleshoot why results are not produced. A case might be you do not have permission to search particular index. Sometimes the data source stops sending data that is pulled in the searches. The best way will be to troubleshoot the searches and see what causes them to not fetch any results. ... View more

It should be LISTENING or ESTABLISHED on the HF for port 9998. If it is listening, then you can Telnet from the server to the HF on port 9998. If the telnet is successfull, there is no connectivity problem. If the telnet shows access denied, then there is a some filtering happening either through a network firewall or Linux firewall. If this is a linux machine, you can run tcpdump to see if you are receiving data. tcpdump -A -i <ethernet card name> port 9998 It should show packets flowing. ... View more

I am using Splunk Enterprise 7.2.4 Below is my Stanza [STANZA NAME] action.email = 1 action.email.include.results_link = 0 action.email.include.view_link = 0 action.email.mailserver = localhost action.email.message.alert = {"RANDOM TEXT }} action.email.priority = 1 action.email.subject = <RANDOM TEXT> action.email.to = RANDOM EMAIL ADDRESS alert.digest_mode = 0 alert.expires = 1h alert.severity = 4 alert.suppress = 0 alert.track = 1 counttype = number of events cron_schedule = 0,15,30,45 * * * * description = RANDOM DESCRIPTION dispatch.earliest_time = -15m dispatch.latest_time = now display.events.type = raw display.general.type = statistics display.page.search.mode = verbose display.page.search.tab = statistics enableSched = 1 quantity = 0 relation = greater than request.ui_dispatch_app = search request.ui_dispatch_view = search search = <SEARCH STRING> ... View more

If you think my answer is helpful, please upvote and mark my answer as solution. Thanks. ... View more