Hello @ITWhisperer , thks for sharing. Still the same. ... View more

Yes, Splunk ES content update is different app https://splunkbase.splunk.com/app/3449/ +1 SA-Investigator for Enterprise Security :  https://splunkbase.splunk.com/app/3749/ ... View more

This may be subjective 🤣, anyways can be a good discussion - Splunk Enterprise Security - InfoSec App for Splunk - Splunk ES Content Update - Splunk Security Essentials for Ransomware ... View more

Try using index="windows-servers" sourcetype = WinEventLog:Security EventCode=4625 | stats count as "Number of Times showing up" values(EventCode) as EventCode by Message Workstation_Name action user | rename Workstation_Name as Hostname,user as " User Account",action as Action ... View more

Splunk TAs are mostly hidden, because most of the TAs don't  have any dashboard (only visible if required configuration inputs) To make it visible - Go to Manage Apps - To extreme left to your App/TA you will see "Edit Properties" - Change "Visible" setting from No to Yes   To your second question, "How do I hide an app from popular view so it is only viewable by Admins?" - You can define App/TA visibility based on Roles https://community.splunk.com/t5/Archive/Hiding-Apps/m-p/29154 You can go to the Application in Manager (Manager » Apps » » Permissions) and set the role that has access to a particular application. That way you can control what apps a group of users have access to. ... View more

If you are using "Splunk Cloud" Trail, I guess the answer is NO. If you want to perform testing for Azure/Event Hub, I would suggest to install "Splunk Enterprise" on your test machine Or create instance on "AWS/Azure". (this will give you flexibility to customize your configuration settings). ... View more

Access Tracker is part of "Asset and identity" module for Splunk ES app to access "inputlookup:access_tracker" you 1st need to add asset data/lookup by using - From the Splunk menu bar, select Settings > Lookups > Lookup table files. - Click New. - Select a Destination App of SA-IdentityManagement. - Select the lookup file to upload. - Type the Destination filename that the lookup table file should have on the search head. The name should include the filename extension. - For example, network_assets_from_CMDB.csv - Click Save to save the lookup table file and return to the list of lookup table files. Reference : https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Configurenewassetoridentitylist For more details on "Asset and Identity" Module follow https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Addassetandidentitydata ... View more

Check in props.conf and adjust timezone settings with "TZ" for your sourcetype Example [your sourcetype] TZ = GMT https://community.splunk.com/t5/Archive/How-to-adjust-the-time-zone-for-an-logs-coming-into-splunk/m-p/306839   ... View more

any specific error message ? ... View more

If you are building dashboard, I am not sure if you checked details captured by @niketn in below mentioned post.   https://community.splunk.com/t5/Dashboards-Visualizations/Jquery-datepicker-in-splunk/m-p/361049   ... View more

1. Is this query correct to know how long it is configured to go to frozen? | rest / services / data / indexes | fields title froz * | rename title as index -- Yes SPL is correct 2. If I need it not to store the logs for 6 years, which is the value that I see by default, and I need it to store the logs for 6 months, understanding that when the log reaches 6 months it would go to a frozen state and splunk would begin to eliminate the older data. -- https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Setaretirementandarchivingpolicy   The maxTotalDataSizeMB and frozenTimePeriodInSecs attributes in indexes.conf help determine when buckets roll from cold to frozen.   3. I should create a file called indexes.conf in the "local" folder and set the value frozenTimePeriodInSecs = 15778800 -- Yes , 15778800 (seconds) means something near to 6 months (60*60*24*180) and for exact value is 15552000 (considering 30 days in each month). b Should I go to the bin and restart the splunk service for it to take the changes? -- Yes, if you are on "standalone infra" Splunk restart required and if you are on a "indexer cluster" a configuration push with rolling restart of all the peer nodes required. 4. Would this change immediately erase logs that are already 6 months old in seconds? or does it start from this moment? -- Its not very immediate, based on your infra may take 2-10 min (again its based on your Splunk infra). ... View more

If your IIS logs are getting stored on a Specific location/path on a system you can try installing a UF and perform "file and folder monitoring to that location/path. https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/Monitorfilesanddirectorieswithinputs.conf https://docs.splunk.com/Documentation/AddOns/released/MSIIS/Setupaddon     ... View more

Can you share your query for better understanding. ... View more

Try this if this helps   index=* source="WinEventLog:Security" (EventCode=4720 OR EventCode=624) | eval CreatedBy = mvindex(Account_Name,0) | eval New_User = mvindex(Account_Name,1) | search CreatedBy=* | table _time EventCode CreatedBy New_User ... View more