Great, now if I wanted to compare the lastlogontimestamp value to todaysa date and fine users who havent logged in for 'X' days... how would someone do that? ... View more

do you do this on the indexer or search head? is the data truncated or is the display of the data truncated? ... View more

BUt if you eval on search head it is extremely slow process verse having the indexer only return valid data. I am now trying this with a 7.0.0 universal forwarder and the same issue STILL exists... When is splunk going to fix this obvious mistake? ... View more

if this is true, why do my splunk servers running windows 2012r2 create the date_* field for there own eventlogs? they are using the same props.conf and Splunk_TA_windows app. when I seach there windows log, they return date_* fields. None of my universal forwarders on windows servers 2012r2 or otherwise or my windows 7 clients do. the only difference I can find is all my servers (Search heads, indexers, mast indexer, deployment server) are running splunk enterprise. My other systems are running universal forwarders. I have used universal forwarder 6.4.0, 6.5.0 and am now trying 7.0.0. it would make sense if NONE of my windows events gave date_* fields.... but they do. I really would prefer this work to take load of search head parsing days and hours from search to return non-business hour logins. I can do this using eval to create the fields but it is EXTREMELY slow and search head intensive as it has to return all results the evaluate and parse them. Vice only returning the valid events from the Index using date_wday and date_hour. ... View more

https://answers.splunk.com/answers/221233/why-are-date-fields-are-not-being-extracted-from-w.html Is there any truth in the above link? Why do my enterprise servers running windows using the same inputs.con and Splunk_TA_windows work? ... View more

I Use the EXACT SAME input.conf and SPLUNK_TA_WINDOWS app on the enterprise servers and forwarders (Splunk is installed on 2012R2 servers). My search head gets the same app from deployment server that all other UFs for windows are receiving (and search head is working), indexers get it from Index Master in his Master-Apps directory pushed as a configuration bundle. Again, all 6 splunk enterprise servers DO create date_* fields and I can query them. but my other machines using universal forwarders DO NOT. (Inputs.conf is in the local directory of SPLUNK_TA_Windows, (I do not edit ANY files in default, and Props is only in Default I did not copy it to local on any servers or clients) Input is straight from the SPLUNK_TA_WINDOWS/default/inputs.conf except I set disabled to false and created a couple whitelist and blacklists to parse out extraneous log data. basically I am pulling the following wineventlogs (I am not pulling any monitors or performance data, only windows EVT/EVTX files) [default] evt_resolve_ad_obj = 1 evt_dc_name=asep.tsmil.mil [WinEventLog://Application] disabled = 0 start_from = oldest current_only = 0 Whitelist = 16, 11707, 11724, 50, 51, 900, 901, 902, 903 Checkpointinterval = 5 index=wineventlog renderxml=false [WinEventLog://Windows Powershell] disabled = 0 start_from = oldest current_only = 0 Checkpointinterval = 5 index=wineventlog renderxml=false [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 Whitelist = (A lot of specified event IDs (I am getting the evnt IDs and the events) blacklist = (specific event IDs with messages = a regex expression where the data is too chatty and irrelevant.) Checkpointinterval = 5 index=wineventlog renderxml=false [WinEventLog://System] disabled = 0 start_from = oldest current_only = 0 Whitelist = 16, 11707, 11724, 50, 51, 900, 901, 902, 903 Checkpointinterval = 5 index=wineventlog renderxml=false The rest of the default in input.con for SPLUNK_TA_Windows are disabled. ... View more

I have to manually retype the inputs but I can do that if necessary, this is a closed network it is running on. So the UFs are running 6.5.0 and the splunk_TA_Windows the splunk_TA_WIndows is the same app used on the UFs and the Splunk enterprise servers. It was my understanding, (and my knowledge is spotty at best) that the UFs cannot do parsing and they rely on the Indexer to do the parsing for them. If so, that would explain the behavior and the indexer is just failing to parse the data. and each splunk Enterprise server is doing there own parsing. If I am incorrect on the UF not being able to parse, then I assume the porps.conf in the Splunk_Home/etc/apps/Splunk_TA_Windows/default directory would be handling the parsing. If so? could it be the windows TA App I am using off of splunkbase? I use that exact same app on my enterprise servers. IF The UF IS unable to do parsing, how do I make my indexers do the parsing? Obviously they are NOT. The indexers have the SPLUNK_TA_Windows app running in SPLUNK_HOME/etc/slave-apps/SPLUNK_TA_WINDOWS (Of course a default and props.conf etc...) Do I need it in the APPS folder as well as the slave-apps if I want it to do the parsiong for my UFs? Is it capabale of doing the parsing for my UF? FYI, I have a 3 indexer cluster and I believe it has plenty of PROC power and Memory to handle the load. ... View more

Thank you for answering, I was Running Smart Mode, but Verbose mode is not working Either.... ... View more

Okay, so I have discovered all 6 of my splunk servers are properly creating the date_* fields. None of the clients I have are creating these fields. They all receive there configurations from a deployment server. I am running SPLUNK_TA_windows which is being pushed from a deployment server. The only files I have in the local directory are inputs.conf, outputs.conf and wmi.conf. Which means the props.conf and other config files are defaults. I have not edited any defaults... I am using the SAME TA on my splunk servers, my search head gets its config fro mthe deployment server also and it appears to be functioning properly. When I was running this is my lab it was also working fine. The issue is residing in my production environment. I am reviewing the docs you attached (thank you for that), where else should I look? Could the TA be corrupted on all my workstations? Should I delete it, let all clients remove the TA then get a clean copy installed? Should I run a command on a client to see if it is properly applying any of the confs? I am completely lost as to why the splunk servers are creating the fields for there records but none of my other servers are. For reference this is windows security logs. I have a mixed 2008/2012/2016 environment. All my splunk servers are 2012. I have many other 2012 servers as well. the logs are gathered and transmitted utilizing Universal Forwarders. I am running 6.5.0 Enterprise and 6.5.0 Forwarders. I see all of the other Security log data, they are just missing the date_* field. I am trying to use a report I wrote for non-business hours logins. But it is only working for logins on splunk servers due to the other systems not receiving a date_* field. ... View more

Well, Do you have McAfee? I had a similiar issue with Python.exe McAfee was Blocking it. ... View more