I have the install file for ver 3.1 and it had the eventgen.conf. 5.1 does not have eventgen.conf. I do not see in the release notes when this was removed. How do I go about using this app to generate events? ... View more

I currently have v8.5 of the Splunk_TA_Windows app, and the following stanza in inputs:   [WinEventLog://AD FS/Admin] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=false    And it seems not to be working. I am also monitoring the Application, Security, and System logs, and they are showing up. I don't see anything in the logs. What am I doing wrong? ... View more

When running a search for"EventCode=35" OR "EventCode=36" OR "EventCode=37" OR "EventCode=38" source="WinEventLog:System" and then exporting that to a CVS file, column N through BN has the following message as its column header, where <workstation> is the workstation name: If_this_is_the_first_occurrence_of_this_event_for_the_specified_computer_and_account__this_may_be_a_transient_issue_that_doesn_t_require_any_action_at_this_time___If_this_is_a_Read_Only_Domain_Controller_and__<workstation>___is_a_legitimate_machine_account_for_the_computer__<workstation>__then__<workstation>__should_be_marked_cacheable_for_this_location_if_appropriate_or_otherwise_ensure_connectivity_to_a_domain_controller__capable_of_servicing_the_request__for_example_a_writable_domain_controller____Otherwise__the_following_steps_may_be_taken_to_resolve_this_problem I am told by the AD team that at leaset Column N should  be a date. Starting at column CC and going through EC, I am seeing this as the header: Otherwise__assuming_that__<workstation>___is_not_a_legitimate_account__the_following_action_should_be_taken_on__<workstation>_ These headers are no where to be found when the search brings back data. they only show up when exporting to CSV.  Anyone have any idea what is going on? ______ Edited to add: I also want to point out this only happen when searching in Smart or Verbose Mode.  it does not happen in Fast mode. ... View more

I have user A that is getting 3 different roles. Normally this isn't an issue, but one of those roles has a restricted search in it that will only show 4 servers in the main index. 2 of the 3 roles just grants access to specific indexes. The 3rd role grants access to the main index and has the following restriction: (host::serverA OR host::serverB OR host::serverC OR host::serverD)  The issue that I am having is that restriction is carrying over to the other roles.  How would I set this up that only those 4 servers are looked for in main without having those restrictions carry over to the other roles. ... View more

If I were to have the UF run a PowerShell script, and that script stops the UF, does that also end that PowerShell script session? If so, is there a way to keep it running? ... View more

It seems I am having issues setting this up. This is what I am expecting to have in step 2, Site  Host  Source roadrunner.com server1 C:\DIR\server1\roadrunner.com\W3SVC8\u* However, the only way to get a green checkmark is: Site  Host  Source W3SVC8 roadrunner.com C:\DIR\server1\roadrunner.com\W3SVC8\u* I am not sure where to look next. Is this an issue with this app, or the IIS add-on? Also, I have another "site" on the same server, W3SVC6 that is not showing up.   ... View more