This is the one I use and send to my customers:   https://www.youtube.com/channel/UC3tExxdDT9plEIwKWfoCNNw  ... View more

I have a customer who has moved off Intel's Xeon to AMD's Epyc CPUs for their server hardware refresh. Currently their 3 node Search Head Cluster (SHC) sit on EPYC 7502P (32C/64T), 512GB of RAM, 2x 500GB RAID1 SSD servers. Indexers are being migrated to EPYC 7402P (24C/48T) 512GB of RAM, 2x 500GB RAID1 SSD (OS/Splunk), Intel 905P 960GB Optane AIC (hot/warm buckets) and some kind of all SSD storage array. In the end the indexers will go from 6 Intel Xeon-based ones to 4 Epyc Servers. He noted the massive cost savings going to AMD was a no-brainer and will continue to completely discontinue the use of Intel Xeons in all of their data centers. As for performance, they are coming from 2016/2017 era Broadwell-based Xeons and so far the Epyc CPUs are crushing the Intel counterparts in both single threaded and multithreaded performance. The quote from his server vendor for the Core for Core pricing between Intel and AMD was almost 3.5x more expensive going with Intel. He sent me this as a comparison of price/performance between Xeon and Epyc: https://www.servethehome.com/amd-epyc-7002-sku-list-and-value-analysis/ As a former IT Manager and Splunk customer, I would steer clear of Intel CPUs for pricing and security concerns. For the OS, all are running CentOS 8 with the recommended Splunk Linux tuning provided in the docs. ... View more

Bring up the Event Viewer on the Windows box you're trying to get those logs from and verify that it is indeed logging the events under "Applications and Services Logs" ... View more

Did you deploy the add-on to the Windows host you wish to get the logs from? Ideally, you would do this from the Forwarder Manager (Settings->Forwarder Management). Copy the add-on from $SPLUNK/etc/apps to $SPLUNK/etc/deploy-apps. Create a new folder "local" in $SPLUNK/etc/deploy-apps// Copy the inputs.conf from the "default" folder to "local" (the one you just created) Change "disabled = true" to "disabled = false" Verify that the TA_microsoft-windefender folder is on the host you wish to get that data from and then you should be good to go. Restart the forwarder service (services.msc) for good measure. ... View more

Can your network appliance be configured to send syslog over TCP instead? Also, who makes this network appliance? ... View more