Hey all, a bit Microsoft question.... We do want to monitor windows Group Policy changes in our Domain. We have installed Splunk  Add-On and App for exchange and Active directory, and also the relevant content-packs containing some reports about this. We do get event 😊😊 But..... we have also an installed and configured AGPM (Advanced group Policy management, Microsoft Software).Under the terms of that software, Microsoft Advanced Group Policy Management (AGPM) is a client/server application. The AGPM Server stores Group Policy Objects (GPOs) offline in the archive that AGPM creates on the server's file system. Group Policy administrators use the AGPM snap-in for the Group Policy Management Console (GPMC) to work with GPOs on the server that hosts the archive. and also a Few terms: Controlled GPO: A GPO that is being managed by AGPM. AGPM manages the history and permissions of controlled GPOs, which it stores in the archive. Uncontrolled GPO: A GPO in the production environment for a domain and not managed by AGPM.   When you edit a GPO using the AGPM system, you work on a copy of the original GPO. As a result, the Windows Event logs in the Domain Controllers are reporting on a different Object. Thus, the Splunk reports and event types of group policy change can't figure out which GPO is being changed (since the AGPM renames it and create a "new" one) So, after all these words....Is someone can help us find a proper application to monitor and view GPO changes via AGPM in splunk?  did someone encountered this before? Is such product exists? and if there is no other choice - help us to write new searches to catch up GPO changes in AGPM?  Thankx Auto Team ... View more

Hey, We do have Sysmom installed on our Windows servers and workstations A quick description of what sysmon is from docs.microsoft.com (link) "sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log."   Since Sysmon itself does not offer as a product log analysis, we thought that sending the logs into Splunk would be the right solution here 😊 * A disadvantage of this is the need to set up and maintain dozens of Splunk UF's on workstations.... What application do I should install, If we already have deployed Splunk TA Windows? We have found App & addon for sysmon in splunkbase. However, the data Sysmon generates is most of the time windows event logs and perfmon events, so the events would come into indexes generated by the Splunk TA windows. We do not want the information being doubled and collected in both apps under different sourcetypes and indexes.... Have anyone done this before? What's are your reccomendations? Regards, Tankwell ... View more

Hi everyone, I've installed ITSI today in my production environment after successfully installing it in my dev environment. I have a  SHC with 3 nodes in it and I have installed the app as the manual says, using a deployer. After all the SH got the apps I tried opening the ITSI app in one of them (I am using a LB so it picks one randomly), when I click on the app it opens an upgrade page although I have the right version installed.  My team and I tried to install the ITSI again and got the same result. We saw an event that said - "captain is not responding even after 5 minutes" , but the Captain was up and running. It didn't happened to us before and We don't know what to do with this issue, has anyone seen it before?  Any help would be good! thanks, Omer Shira ... View more

Hey, Is there a way to set indexer hostname by environment Variable? We plan to deploy this Env variable with deployment server in order to set all indexer hostnames... we have tried this: [default] host = $HOSTNAME without any changes [the hostname of the indexers just changed to "$HOSTNAME"...😢😢] Have anyone tried this before? Is there more efficient way to set indexers hostnames from deployment servers? Thanks Tankwell ... View more

Hey all, We want to start analyzing sysmon information via Splunk (event logs) We did find applications here but it did not met our expectations How do you recommend to do this? Is this is possible to analyze Sysmon information in windows Standard App without a major effort? We do prefer to use splunk apps and addons suppoted by Splunk inc. Thanks Tankwell ... View more

Greetings, We have a Splunk Environment with 3 Search Head in the SHC. We try to perform an ldapsearch command using the SA-LDAPsearch 3.0.2 add-on. The search takes a devastating 18-19 seconds to load on the first and third Search Heads but on the second one it takes 3-4 seconds. We inspected the job and saw that according to the search.log the second SH indeed takes milliseconds between each action meanwhile the other two take 2-3 seconds between each internal step. We tried to speed up the ldapsearch with the "attrs" and "basedn" settings but even though it helped a little bit, 19 seconds is still too much time... The three search heads have identical resources and settings. What can be the cause of this major difference and what can I do to speed-up the ldapsearch or in what way can I debug it better?   Thanks, OmerShira ... View more

Hey, We look for an elegant way to set _meta field in inputs.conf of SAI application [splunk app for infrastructure] We now have the following line in inputs.conf of the SAI application _meta = os::'windows server 2016' os_version::10.0.14393 ip:'10.0.0.1' We are looking for a way to set up this line automatically when running splunk reload deploy server Any suggestions? ... View more

Hello, We installed the Splunk app for VMware in our environment. we followed the documentation and installed the required add-on for VMware that contains all the TA's. We placed the TA's according to the documentation, and configured the app as it said. Now, when we try to look at the app and use it part of the panels are empty. We checked the "app install health collected source types" and according to it we receive all the needed information, for example at the Home tab the Datastore Information is empty. We tried to inspect and looked at the SPL code and run it from the search, we noticed some of the commands are unknown and we couldn't find any details about them, for example those commands appeared:  - ifields - gaugetable We don't know where the problem is, the data dose seem to flow since we do receive a big part of it. Is anyone experienced this issue? Any help would be great!   Thanks, Omershira ... View more

Hello, I wrote an ansible playbook that installs and configures splunk UF. I have created two playbooks, one for linux machines and one for windows. When I run the windows playbook it uses this comman to install the msi file: msiexec.exe /i splunkuniversalforwarder.msi [<flag>=<value>]...[<flagN>=<value>] I was able to set an indexer and a deployment server and to choose which of the windows eventlog inputs to recive data from and so...  the only problem I have is that all the data is sent by default to the "main" index. I cant seem to find a flag that will  send the data at first to a different index. I know I can change it in the inputs.conf file but the idea is to do all the configuration from the playbook without needing to change things later. I want to send all the data from the eventlog to one index, can i set it in the installation command? if not, where can i set it so it won't send any data to the "main" index? Thanks!! omer shira ... View more