I need a report every month of the Active Directory Changes and plan to use Splunk for LogBinder using this instructions https://support.logbinder.com/SuperchargerKB/50135/8-Install-Supercharger-with-Splunk-Light-and-the-Splunk-App-for-LOGbinder. But I am hesitant of the safety of Splunk free, e.g. it has no log in option Can you give me a quote for the license one please? I do not need extra features, just these report. Thank you. Tried it on the Sales site but the submit button is grayed out 🙂 ... View more

Yes. I only need to submit changes made in the Active Directory every month. If I use this, are the data accessed in the cloud since this is using a web browser?  ... View more

This one is for account changes by Domain. I ran it in search bar but still no result. Sorry I'm a newbie so I am not sure if those macros are correct. But even simple search like `select_winseclog_events` (EventCode=4726 OR EventCode=4768) and | inputlookup domain_controllers.. is not showing anything..  ... View more

Now I don't have any errors in searching but still no result. Kindly assist please. Thank you. ... View more

Thank you that worked. But still no result and did not reflect in the dashboard.    ... View more

I see it now thanks. i removed the ' from 'select_winseclog_events' (EventCode=4726 OR EventCode=4768). But still no result found although these events are present in the index=main logs. Kindly help on finding how to reflect this logs on the ADChanges like the last image  from splunk webinar.  ... View more

Hello.  These are my macros. Do I need this `select_winseclog_events`  macros to reflect data to the dashboard? Can you please help me how can I add this please? I was not able to find app that defines the macro. Thank you. ... View more

Thank you for your reply. No results found for all filters in the dashboard. For example, under AD changes account changes by domain: search [ | inputlookup domain_controllers | fields ComputerName ] (index=wineventlog OR index=main) eventtype=WinSecLog EventCode=4738 | search NOT [ search [ | inputlookup domain_controllers | fields ComputerName ] (index=wineventlog OR index=main) eventtype=WinSecLog (EventCode=4738 OR EventCode=4720) |transaction maxspan=1s startswith=4720 endswith=4738 | fields _time TargetAccountName ] | eval Account_Expires_timestamp=strptime(Account_Expires,"%m/%d/%Y %H:%M:%S %p") | where (Logon_Hours=="All" OR match(_raw,"Account Enabled") OR Account_Expires=="<never>" OR Account_Expires_timestamp>_time OR User_Principal_Name!="-" OR SAM_Account_Name!="-" OR match(_raw,"'Smartcard Required'\s*-\s*Disabled") OR match(_raw,"'Don't Expire Password'\s*-\s*Enabled") OR match(_raw,"'Not Delegated'\s*-\s*Disabled") OR User_Workstations="<value not set>" ) | append [search [ | inputlookup domain_controllers | fields ComputerName ] (index=wineventlog OR index=main) eventtype=WinSecLog (EventCode=4720 OR EventCode=4725 OR EventCode=4726 ) ] | eval type=case(EventCode=4738,"Significant Change",EventCode=4720,"New user",EventCode=4725 OR EventCode=4726,"Deleted/Disabled")  I found some of the event codes like 4726 in main=index logs so there should be something reflected in the dashboard. How do I solve error: Error in 'SearchParser': The search specifies a macro 'select_winseclog_events' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information. . when I search for `select_winseclog_events` (EventCode=4932 OR EventCode=4768)?  The fourth image is now resolved when I removed the "|". Please help.     ... View more