I have a need to import older Windows .evt files into my splunk environment. Since the splunk server is on linux I got the impression that I would only be able to import the .evt files from one of my Windows clients that I have the universal forwarder installed on. However, when I go to run the splunk.exe cli to add monitors I get an error stating that Python.EXE cannot be located and it is indeed not anywhere in the splunkuniversalforwarder tree. Is there another way to add this data that I'm not thinking of? ... View more

I'm trying to figure out how real-time charts are built and so far I've had zero success. Even doing something like creating a line chart with 'host=* | stats count' to show event counts over time isn't working. Is this something that can be done with simple XML or do I have to switch to advanced xml? ... View more

Using the following search: |metadata type=hosts |sort lastTime|convert ctime(lastTime)|fields host,lastTime I am able to get a list of all hosts and when the last time splunk saw an event from that host. What I would like to do is create a saved search based off of this sort of search that I can use as an alert if lastTime is greater than some number of hours for any particular host. I was imagining something along the lines of |metadata type=hosts |sort lastTime|convert ctime(lastTime)|fields host,lastTime |where NOW - lastTime > 12h Or something along those lines. Is there a function that would give me NOW (current date/time) and if so, is this the right approach to get what I'm after? ... View more

In my test environment I have several Windows and Linux systems using splunk forwarder to send audit logs to the main splunk server. We have a requirement to detect and investigate failed accesses to security-relevant objects (SROs), which is basically a list of files or directories that we specify. Detecting failed access to SROs with Windows audit events is relatively easy since that is a single event with a well-known event ID. However in Linux that raw audit data looks like 3 separate audit events with a common event id. I've started down the path of creating a custom search script and am able to read in the event data from splunk.Intersplunk.getOrganizedResults but I'm stuck at the point of generating an event to put into splunk.Intersplunk.outputResults. Is there a method to generate a new event (transient?) to return from my saved search? ... View more

I've created a dashboard with several panels, each running different searches. The panels that use saved searches (searchName) wrap the events but will not use the paginators. The panels that use ad hoc searches (searchString) will paginate but will not wrap the events, forcing scrollbars on the panel. I need the results to be wrapped AND paginated, what is the best approach? ... View more