We have a Windows Universal Forwader installed as service-user (svcSplunk) with read access to ALL eventlogs. (Windows 2008R2) We are getting all eventlogs except "Security" evlogs. We are struggling to find the reason for it. diags show three errors as below - ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-winevtlog.exe" splunk-winevtlog - WinEventLogChannel::init: Init failed, unable to subscribe to Windows Event Log channel 'security': errorCode=5 - ERROR ExecProcessor - Couldn't start command "D:\SplunkUniversalForwarder\bin\splunk-admon.exe": The media is write protected. - ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-winevtlog.exe" splunk-winevtlog - WinEventLogChannel::init: Failed to bind to DC, dc_bind_time=12106 msec I've tested the recommendations in below URL too, but it is NOT related to Security Softwares running: https://answers.splunk.com/answers/248673/why-is-the-splunk-universal-forwarder-on-my-domain.html any help would be much appreciated ============ update ============ PS: (the other options/test we tried already) Windows Application, system eventlogs are read and working correctly. Problem is ONLY with Wineventlog:Security With admin permissions everything works perfect including Security logs No Security softwares running Created an interactive "test" user with same level of permissions as svcSplunk. As "test" user, eventlogs are readable ... View more

May be a quick question to UI experts out there. My dashboard have auto-refresh enabled, but wanted to show the "last updated" (refreshed) time in another panel. Is there an easy simpleXML function for this? (I'm thinking of running a dummy search and putting the timestamp as last resort) Cheers ... View more

As per the URL http://docs.splunk.com/Documentation/ES/4.2.0/User/Configureblocklists We are looking for : Add a URL-based threat source -> Threat Intelligence Downloads. After configuring we wanted to check if it has worked. Where is the final lookup/csv file cached/stored? ... View more

We are trying to collect data from certain secure Windows Systems and the team have requested to install "Splunk Universal Forwarder" with minimal permissions within a domain group. (svcSplunkSecureWindows) We are getting below Error: splunk-winevtlog - WinEventLogChannel::subscribeToEvtChannel: Could not subscribe to Windows Event Log channel 'security' The real question may be is not a Splunk query, but to Windows Guru's out there: - How to attach a group read access to particular Windows Eventlog? so that "svcSplunkSecureWindows" group can read it. ... View more

Hi, From authorize.conf specific srchIndexesDefault = <string> * Semicolon delimited list of indexes to search when no index is specified * These indexes can be wildcarded, with the exception that '*' does not match internal indexes * To match internal indexes, start with '_'. All internal indexes are represented by '_*' * Defaults to none, but the UI will automatically populate this with 'main' in manager So as per docs, we an use full wildcards. Just wanted to check if we can mix wildcards && specific indexes. So is below possible? srchIndexesDefault = web_*;*network_*;myspecialindex Also, is there any chance of blacklist concept in authorize.conf? I really feel it is worth to Splunk to enable this as we can do whitelist & blacklist indexes to roles ... View more

hi, we were normally controlling around 250 clients using one server, but suddenly clients increased to 500+ and we are planning to bring to horizontally extend deployment servers. We want to temporarily protect the deployment server by putting "phoneHomeIntervalInSecs" to 900 (15mins) for atleast 2 months Is this Ok? (other than client getting updates slightly delayed) Will there be repercussions if deployment-server doesn't get answer more than x minutes? Cheers ... View more

I feel the below answer and test blog is quite old (4 years). - https://answers.splunk.com/answers/10417/splunk-on-solid-state-disk.html - http://blogs.splunk.com/2012/05/10/quantifying-the-benefits-of-splunk-with-ssds/ Does anyone have a recent analysis and performance measurement of Splunk 6.4.x (especially) clustering with SSD? Any other major issues if we migrate to SSD's for indexer clustering? ... View more