How would you do it without Splunk? That's a good place to start. For Microsoft SQL Server, there is a good start in the Splunk App for Microsoft SQL Server on apps.splunk.com - however, it doesn't tell you all the information you are after. You will need to create data inputs that do dumps of the DMVs on a regular basis or you may have to write triggers for specific events to be logged. For Oracle, there is an Oracle Add-on but again - it depends on how deep you want to go. Inevitably, you will want to add specific inputs for specific things that you want to see. ... View more

All of the channels seem to be reasonable, so there is no reason why they shouldn't be read unless there is a permissions issue. Check the log files on the forwarder in %SPLUNK_HOME%\var\log\splunk - most notably splunkd.log (you can do this from the splunk instance by searching index=_internal source=*splunkd.log host=) for any errors in the WinEventLog modular input. ... View more

To determine if there is an app for any technology, search on http://apps.splunk.com The TA-SMTP-Reputation included as part of the Microsoft Exchange app is for checking your reputation, not others. As a result, it doesn't know anything about ProofPoint. ... View more

Upgrade your forwarder to 6.2. (I saw the note that the wizard ended prematurely - you need to solve that!) then use the useEnglishOnly parameter as described here: http://blogs.splunk.com/2014/11/10/splunk-6-2-feature-overview-perfmon-delocalization/ Your alternative is not very pretty, but is described in this blog post: http://blogs.splunk.com/2013/06/17/windows-perfmon-and-internationalization/ ... View more

There were a whole slew of old bugs that were corrected in v1.0.1 that dealt with GPOs and alternate forms of the GPO. It looks like you have bumped into them again. But your version is new enough that they should not be an issue. Can you show off an example event please? The search is "eventtype=msad-ad-access Object_Type=groupPolicyContainer|head 1" ... View more

Those are the latest versions, so you should have no problem. I'll need to set up a reproduction. What version of Windows are you using? Whats the forest and domain level? ... View more

If you are using Windows DHCP then you can monitor that and as it gives out assignments, log that. You can read about the log file here: http://technet.microsoft.com/en-us/library/dd759178.aspx Once you have the data, create a temporal lookup of _time,src_ip,src_host and use that. Read about temporal lookups here: http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-bounded_lookup ... View more

Any of the above. I'd recommend the Heavy Forwarder, if it has Internet Access. ... View more

Sensitive accounts are accounts that have the TRUSTED_FOR_DELEGATION flag set in the userAccountControl field. These accounts are service accounts (either user or computer) that has kerberos delegation enabled. If you don't have any users or computers with this facility, it's likely you will see "No Results" - this isn't an error - it just means there aren't any of that type. You can read about the fields in userAccountControl here: http://msdn.microsoft.com/en-us/library/ms680832(v=vs.85).aspx ... View more

What version of the Windows Infrastructure app are you using? What version of the SA-ldapsearch app are you using? Please ensure you are running v1.1.13 of SA-ldapsearch and the latest Windows Infrastructure app. Then let me know if the same thing is happening? My thought is that this is a different manifest of a GPO bug we fixed in the last release. But I'll need you to upgrade in order to figure that out. ... View more

How is your Splunk instance configured? Do you have it behind a proxy? Do you have Search Head Pooling configured? ... View more

The field comes directly from the Printing API in use, so it's generated by Windows. On my Windows Server 2012 R2 print server, it's always filled in. However, your best bet is to look at the actual data - it may be that total_pages is the field you want. I'll do some tests next week and update the blog post if necessary. ... View more

There are several things that can be going wrong here. Your best bet is to look in the splunkd.log (you can use your Splunk instance for this - index=_internal source=*splunkd.log) for the culprit. Things to ask: 1) Did you restart the UF after copying the TA into the etc/apps area? 2) What data is coming in? 2.a) Is the data for the perfmon and WinEventLog stanzas coming in? 2.b) Is the data for the netlogon.log coming in? 2.c) Which PowerShell commands are actually executing and which ones are failing? 3) Have you installed WinRM 3.0 and PowerShell v3? If it's just the PowerShell stuff that is failing (which would be my initial thought), then downloading psexec and running psexec -s to get a system shell would be a start. You can then run the powershell scripts as the user that is running the universal forwarder and check for errors. Check out this blog post: http://blogs.splunk.com/2013/05/29/running-as-a-windows-service/ ... View more

0x80004005 (which is the error code in your initial log leading to the failure) is "Access Denied" - it generally means that the user that is attempting to run the installer does not have permission to read the registry for the settings. Quite why that is happening is unclear, and could be a bunch of things - including a failed (further on) install leaving a corrupted registry, running the installer as a non-Administrator, or any number of other things. Unfortunately, that's not enough to repair the situation. Maybe now you have installed the 6.1.3 version, you can re-try and see if it works. ... View more

Ok - change your binddn back to what it was in v1.1.3 - I'm not sure why you changed it then complained the new one didn't work. Documentation is available on http://docs.splunk.com as always. ... View more

That seems like a bug to me. Please work through Splunk Support to get it filed - they will ask for additional information. We will need some details on how your Exchange environment is set up as well (in terms of databases on the machine) so that we can reproduce. ... View more

Would this blog post assist? http://blogs.splunk.com/2013/05/09/are-all-my-microsoft-servers-being-splunked/ ... View more

It should work. The attribute error indicates that there is an attribute being asked for that isn't valid or you don't have permission to read. We're going to be releasing v2.0.1 shortly and this problem will be fixed at that point. Until then, I recommend downgrading to v1.1.13. ... View more

Sorry - didn't see this until today. We got a whole bunch of support questions about this app and my recommendation is to wait for 2.0.1 before upgrading at this point. It's currently going through QA and will be released shortly. ... View more

Please post your ldap.conf for a full answer. ... View more