Hey All, I am very new to Splunk. I have installed my first Splunk server/index/deployment server on a single server and have also just installed the following applications: Windows Infrastructure, Splunk LDAP Support and Splunk_TA_windows As per the manual I configured and copied the relevant apps to my deployment-apps folder being: SA-ModularInput-PowerShell, Splunk_TA_windows, TA-DNSServer-NT6 and TA-DomainController-2012R2 as per my environment. Having installed the universal forwarder on my first DC (Server 2012 r2) it has received the apps using the deployment server as expected. Looking at the splunk and metrics log on my forwarder I can see I am connected to the splunk server on 9997 and events are listed in metrics.log however my indexer shows that all non-internal indexes are empty. Looking at the metrics log on the indexer I can see this log has already rolled a number of times and shows events from DC. I have checked the inputs.conf in Splunk_TA_windows and confirmed the items I am interested in are enabled as a starting point. Any suggestions on what I should be looking at next? ... View more

Morning All, I would like to export index data from my Production instance of Splunk and import that same index data into a Test instance of Splunk for the sole purpose of evaluating apps, refining searches and education purposes. The Test instance will not need to receive any further data, ideally it will exist on a standalone server and I don’t mind exactly how much data I have in the index (perhaps 60 days) as the sources have been consistsnet for some time now. If I can do something as simple as copy some cold index files that approach works too. I have reviewed the wiki article ”How to move an index from one Splunk installation to another” (http://wiki.splunk.com/Community:MoveIndexes) and it appears I only need to follow steps 2 and 3. Can someone please offer some advise as to whether this is the best approach to achieve my goals of evaluating and tuning potential apps, refining searches and education purposes. Thanks, Adam ... View more

Hi All, I am brand new to Splunk and I'm looking for a quick helping hand to get me started. I'd like to create a simple table (or any other useful display mechanism) to create a dashboard or report to show changes to my local servers. I am specifically interested in showing events 4720, 4738 and 4726. Initially I would like to start with 4720 (see below). I would like to display the time the event occurred, on which host, the user who created the account, the account name and finally extract the text "Message=A user account was created." to appear in the last column. Once I understand how to do this I should be able to replicate this for my other events. May I please ask for some assistance while I'm still learning. Thank you. 8:05:24.000 PM 10/30/2012 08:05:24 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4720 EventType=0 Type=Information ComputerName=LabMGT.Test.Com TaskCategory=User Account Management OpCode=Info RecordNumber=346 Keywords=Audit Success Message=A user account was created. Subject: Security ID: LabMGT\Administrator Account Name: Administrator Account Domain: LABMGT Logon ID: 0x1c912 New Account: Security ID: LabMGT\Walter Black Account Name: Walter Black Account Domain: SORCEDMGT Attributes: SAM Account Name: Walter Black Display Name: User Principal Name: - Home Directory: Home Drive: Script Path: Profile Path: User Workstations: Password Last Set: Account Expires: Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: Account Disabled 'Password Not Required' - Enabled 'Normal Account' - Enabled User Parameters: SID History: - Logon Hours: All Additional Information: Privileges - Collapse back to 10 lines host=LabMGT Options| sourcetype=WinEventLog:Security Options| source=WinEventLog:Security Options ... View more