i installed universal forwarder 4 machine this event log is getting my pc i want to compare my event log and universal forwarder ip address as where i receive so i use to lookup index="_internal" to get hostname and compare my event log host event log index index=*  EventCode=4624 the check index of the universal forwarder is index=_internal query: index=_internal fwdType=uf | table hostname sourceHost | rename hostname as uf_username sourceHost as uf_hostname | join sourceHost [search index=* EventCode=4624 Source_Network_Address=* Account_Name=Administrator Account_Domain=* | table Source_Network_Address Account_Name host] how to compare this and if the host name matches both indexes and get the ip address from index=_internal fwdType=uf sourceHost and  index=*  Source_Network_Address ... View more

i created python scripts using splunk sdk and when i used my laptop it worked fine but when i try to use in splunk windows machine i get an error DeprecationWarning: ResultsReader is a deprecated function. Use the JSONResultsReader function instead in conjuction with the 'output_mode' query param set to 'json' reader = results.ResultsReader(query_results) ... View more

I used cyberark and created 3 servers via cyberark and installed splunk this server machine 192.0.0.1 via cyberark access remote desktop connection. Currently, this machine gets an event log. If someone accesses this machine, a login event is received in splunk but it doesn't show that the login event occurred from where? The windows event log has src ip, but does it mean where did the login event occur from? If the client PC logs into the Windows server directly, that is the IP address of the client PC. If the client PC logs into the Windows server through CyberArk, that is the CyberArk IP address. I want the windows event log to send IP. In the two cases above, I want to get the IP address of the Windows server. Flowchart ... View more

i created a custom python api script and it works fine and i want to import in splunk so i put my script. "C:\\Program Files\\Splunk\\etc\\apps\\search\\bin\\sample.py" I run cmd and the result is getting correctly in splunk i created data inputs -> scripts -> select my scripts -> select source type _json -> app context App Browser -> selected index but i am not getting any json results in splunk search index Is there any configuration needed? when i check input.config it is already correctly the file details, so why splunk index doesn't show any json data? [script://$SPLUNK_HOME\etc\apps\search\bin\sample.py] disabled = false host = home index = jsearch interval = 60.0 sourcetype = _json    ... View more

I have a windows esxi server and installed splunk on this server and installed "Splunk Add-on for Windows" and created a local file in the Splunk folder and input.config is used Wineventlog is enabled and local event log is received in Splunk this server installed "cyberark" also for client to access this esxi server using from "remote desktop connection" Question: Does my local esxi server splunk get an event log to get login details for someone to access my "remote desktop connection"? my event log is currently receiving the local event log and there is no srcip and no port, ip address details and everything is empty Maybe Splunk runs locally and gets a local event log, meaning it doesn't show any ip address and port or srcip sections in the g event? I need to receive if someone accesses my machine from "remote desktop connection" then the event log I want to receive the IP address details is required, do I need to change any input.config to receive the address information IP correctly? Should i create a stanza in input.config to receive the login event log in splunk ?like this example? [WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational] disabled = 0 index = wineventlog start_from = oldest current_only = 0 checkpointInterval = 5 renderXML = false or [WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational] disabled = 0   ... View more

(New splunk user) I want to use the Cyberark Rest Api login event for Splunk. So is there a way to access Rest API data directly from Splunk? or  Do I need to use Rest Api, some programming like Python to get the data and then send the splunk? or direct rest api endpoint binding to use in splunk install available? Is there any idea about this flowchart to connect Splunk?     ... View more