I have the install file for ver 3.1 and it had the eventgen.conf. 5.1 does not have eventgen.conf. I do not see in the release notes when this was removed. How do I go about using this app to generate events? ... View more

I currently have v8.5 of the Splunk_TA_Windows app, and the following stanza in inputs:   [WinEventLog://AD FS/Admin] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=false    And it seems not to be working. I am also monitoring the Application, Security, and System logs, and they are showing up. I don't see anything in the logs. What am I doing wrong? ... View more

When running a search for"EventCode=35" OR "EventCode=36" OR "EventCode=37" OR "EventCode=38" source="WinEventLog:System" and then exporting that to a CVS file, column N through BN has the following message as its column header, where <workstation> is the workstation name: If_this_is_the_first_occurrence_of_this_event_for_the_specified_computer_and_account__this_may_be_a_transient_issue_that_doesn_t_require_any_action_at_this_time___If_this_is_a_Read_Only_Domain_Controller_and__<workstation>___is_a_legitimate_machine_account_for_the_computer__<workstation>__then__<workstation>__should_be_marked_cacheable_for_this_location_if_appropriate_or_otherwise_ensure_connectivity_to_a_domain_controller__capable_of_servicing_the_request__for_example_a_writable_domain_controller____Otherwise__the_following_steps_may_be_taken_to_resolve_this_problem I am told by the AD team that at leaset Column N should  be a date. Starting at column CC and going through EC, I am seeing this as the header: Otherwise__assuming_that__<workstation>___is_not_a_legitimate_account__the_following_action_should_be_taken_on__<workstation>_ These headers are no where to be found when the search brings back data. they only show up when exporting to CSV.  Anyone have any idea what is going on? ______ Edited to add: I also want to point out this only happen when searching in Smart or Verbose Mode.  it does not happen in Fast mode. ... View more

I have user A that is getting 3 different roles. Normally this isn't an issue, but one of those roles has a restricted search in it that will only show 4 servers in the main index. 2 of the 3 roles just grants access to specific indexes. The 3rd role grants access to the main index and has the following restriction: (host::serverA OR host::serverB OR host::serverC OR host::serverD)  The issue that I am having is that restriction is carrying over to the other roles.  How would I set this up that only those 4 servers are looked for in main without having those restrictions carry over to the other roles. ... View more

If I were to have the UF run a PowerShell script, and that script stops the UF, does that also end that PowerShell script session? If so, is there a way to keep it running? ... View more

It seems I am having issues setting this up. This is what I am expecting to have in step 2, Site  Host  Source roadrunner.com server1 C:\DIR\server1\roadrunner.com\W3SVC8\u* However, the only way to get a green checkmark is: Site  Host  Source W3SVC8 roadrunner.com C:\DIR\server1\roadrunner.com\W3SVC8\u* I am not sure where to look next. Is this an issue with this app, or the IIS add-on? Also, I have another "site" on the same server, W3SVC6 that is not showing up.   ... View more

A quick search didn't find anything. I am looking to determine what the most used and avg Search window is. I.e. how far back are most of my users actually looking. Is this possible? ... View more

We have several log entries with what boils down to a transaction ID. I want to group these entries and within those groups, I want to create an alert that will trigger if a phrase shows up 10 or more times in 5 min. Below is what I currently have, but I don't think I am headed in the right direction.   index=index_name host=server_name sourcetype=moveit:fti* | transaction tasknumer maxspan=300s | search "could not get id" ... View more