Thank you @diogofgm this worked! ... View more

https://www.splunk.com/en_us/blog/security/att-ck-ing-the-adversary-episode-3-operationalizing-att-ck-with-splunk.html https://splunkbase.splunk.com/app/3435/ https://www.jpcert.or.jp/english/pub/sr/ir_research.html https://docs.splunk.com/Documentation/ESSOC/1.0.53/stories/UseCase ... View more

If I run these two searches, the Statistics totals are 29 and 28 - only off by one (which makes sense because I excluded only one machine). Therefore that seems to add up correctly. Not sure why my original search only showed 5 systems. index=*-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=administrator | table src_nt_host | dedup src_nt_host index=*-windows-logs (EventCode=4624 AND Logon_Type=3) Account_Name=administrator src_nt_host!=machineA | table src_nt_host | dedup src_nt_host ... View more

Thanks @snallam123 !! ... View more

If you built them then you should have permissions to view them. Are you sure the others fired? ... View more

You rock that worked too! ... View more

and if you want to get hold of all your other fields in the data, then you probably need to look at eventstats rather than stats. Stats will aggregate and remove the non aggregated data, whereas eventstats will perform the same aggregations as stats, but will add those aggregations back into the original event data, leaving all the original fields there to play with as you like. ... View more

Thank you rich! ... View more

This has been solved many times including: Meta Woot!: https://splunkbase.splunk.com/app/2949/ TrackMe: https://splunkbase.splunk.com/app/4621/, Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/ Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/ Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/ Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarder_warnings ... View more

As others have said, you can use a subsearch which probably is the correct way. You can also use map which is the converse of subsearch . ... View more

for (eventcode=4672+eventcode=4624+eventcode=5140) occurs same time index=wineventlog (EventCode=4624 OR EventCode=4624 OR EventCode=5140) Authentication_Package=Negotiate | eval time = _time | bin span=1s time | stats dc(EventCode) as EventCode_count by host time | rename time as _time | where EventCode_count =3 ... View more

In general, no. UFs are very straightforward to deploy. Problems are always possible, however, if you exceed the capacity of any of your resources. ... View more

just add the field that represent computer name in the query after the by clause in every stats line also here is the duration in Hours Minutes Seconds and Days index=win* sourcetype="WinEventLog:security" (EventCode=4634 OR EventCode=4624) | stats min(_time) as first_event max(_time) as last_event by EventCode user ComputerName | eval login_first=if(EventCode==4624,first_event,null()) | eval logoff_last=if(EventCode==4634,last_event,null()) | stats values(login_first) as login_first values(logoff_last) as logoff_last by user ComputerName | eval duration_in_system_sec = logoff_last - login_first | eval logoff_last_human = strftime(logoff_last, "%c") | eval logon_first_human = strftime(login_first, "%c") | eval duration_human = tostring(duration_in_system_sec, "duration") ... View more

based on a stealthebits blog, You want to look for event 4624, Logon type 9, Authentication Package = negotiate, Logon Process = seclogo ... View more

diag will simplify your backup process on the indexers, youll probably want to backup the data too. https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Backupindexeddata#Choose_your_backup_strategy another elaborated answer here: https://answers.splunk.com/answers/469816/what-is-the-best-practice-to-backup-splunk.html ... View more

Exactly. You definitely should start there and come back here after that and click Accept either on this answer or on your answer after posting what you actually did. ... View more

Something like the following would count the number of unique hostnames ( dc = distinct count) that the Admin has logged into. index=wineventlog Logon user=Administrator earliest=-65m@m | stats dc(hostname), values(hostname) You may also want to look at the Security Essentials app, https://splunkbase.splunk.com/app/3435/ , which hassome examples of such searches and use-cases. ... View more

Like this: | tstats summariesonly=t count values(dest) AS destCount FROM datamodel=Authentication WHERE index=* AND nodename=Authentication.Failed_Authentication BY Authentication.src_user | where destCount >= 2 ... View more

Thanks I think that will get me kickstarted! ... View more

Thank you! ... View more

The main question is: how did you install the UF? If it was installed using a privileged account and you are now trying to start it with a non-privileged account, it will probably fail, as that account does not have the required permissions on the install dir. It is possible to run Splunk under a non-admin user, but then it also needs to be installed as such I think (or you need to manually update the permissions on the Splunk install dir such that the account you want to use has access to that). See also: http://docs.splunk.com/Documentation/Forwarder/7.2.1/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller#Install_the_universal_forwarder_in_.22low-privilege.22_mode ... View more

Thank you! This worked ... View more

hello there, hope this link will help: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEP9 ... View more

That worked! ... View more