About gerdhuber

gerdhuber · ‎07-31-2017

This works for me: whitelist1 = EventCode=%^(4624)$% Message="Logon\sType:\t+10" whitelist2 = EventCode=%^(4625|4647|4720|4722|4724|4725|4726|4738|4781)$%

aakwah · ‎05-17-2017

Hello, If the trigger of the execution of the script is based on search results, then you can use Splunk alerts to achieve this. After you search is completed, click on Save As -> Alert -> Add Actions -> Run a script -> type script name. Location of script: $SPLUNK_HOME/bin/scripts Regards

gerdhuber · ‎03-23-2017

Thank you

niketn · ‎03-13-2017

@gerdhuber, Sorry I misunderstood your question. I have edited my answer below to reset the default Dashboard for specific user back to Choose a home dashboard option using user-prefs.conf. Please try out and let me know whether the same works for you or not.

skoelpin · ‎02-20-2017

Can you please accept the answer and close it out?

Posts	11
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎02-16-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Whitelist for WinEventLog does not filter with two...

Scheduled shell-script to copy data like csv-files...

Need help with regex in transforms.conf to find tw...

Set the default Dashboard to Splunk-Standard

inputs.conf is there a difference

Re: Whitelist for WinEventLog does not filter with...

Re: Scheduled shell-script to copy data like csv-f...

Re: Need help with regex in transforms.conf to fin...

Re: Set the default Dashboard to Splunk-Standard

Re: inputs.conf is there a difference

Join the Conversation