Need help with search command that would have the ability to track a list of even log IDs ... View more

I'm trying to know why I can't feed data in splunk. I'm trying to get data from windows servers to splunk, I've created a UF on the Windows server that has the data that needs to be forwarded to splunk. I've configured inputs and outputs.conf files on the forwarder and have also configured inputs.com file on the indexer, all ports are opened, everything is set but I'm still not getting data in splunk. Any help? ... View more

Are there any Splunk app out there that can help with automation apart from other automation tools? ... View more

Hello, I had requested for anyone to provide me with a good search to monitor after hour employee login and I was provided with what doesn't seem to be a search but rather looks like a macro definition as you can see below. [out_working_time] definition = | eval day=strftime(_time,"%d/%m/%Y")\ | lookup SIEMCAL.csv day OUTPUT type\ | search Tipo=2 OR (Tipo=1 (date_hour>14 OR (date_hour<7 AND date_minute<45))) OR (Tipo=0 (date_hour>20 OR (date_hour<8 AND date_minute<45))) iseval = 0 Can anyone help me with this search, please? ... View more

Hello, I had requested help with a "search language that could determine system logins after core hours" and one of the nice people here puts the below search together for me. does this search need any revisions or is it incomplete? if it does need some revisions can anyone help with such revisions please? [out_working_time] definition = | eval day=strftime(_time,"%d/%m/%Y")\ | lookup SIEMCAL.csv day OUTPUT type\ | search Tipo=2 OR (Tipo=1 (date_hour>14 OR (date_hour<7 AND date_minute<45))) OR (Tipo=0 (date_hour>20 OR (date_hour<8 AND date_minute<45))) iseval = 0 ... View more

I need a good search to monitor after hour employee login, can anyone help please? ... View more

Can any one help with a search language that could determine system logins after core hours? ... View more

Can any one help with a search language that could determine full disks and system logins after core hours? ... View more