THe estreamer app is only compatible with Unix platforms ... View more

Isn't the port in question just what we set in httpport? ... View more

I suggest using Powershell scripting to manipulate your ticket system. Check out http://technet.microsoft.com/en-us/sharepoint/jj672838.aspx for a good starting point for going down that road. You can then use Splunk alerts to launch the Powershell code OR if it is on a different system, use a script on the Splunk server to trigger something across the network (SSH or Powershell depending on your platform, for example). We use similar methods for providing CSV input into a VBScript program that produces reports on things every day. ... View more

[default] index=companyXYZ worked just fine! ... View more

I believe it was the heavy load and lack of power in the thin clients. Everything worked fine today. ... View more

I removed the beginning ^ and it works now. Thanks! ... View more

Another concern I have - what if a service was started and stopped several times within your search time range? Because you are de-duping the Message, you would only see one start and one stop. Is this what you want? It would also be possible to count the number of starts/stops if you didn't dedup... ... View more

you can collect intrusion events from the device directly as there is eStreamer server code on the device. You'll only get IDS events however. No impact flag. You can get IDS and Connection events off the device in syslog too. TAC can help you set this up. On the port, you need to use 8302, not 8320. Doug ... View more

Have you seen the Splunk for InterMapper app? http://splunk-base.splunk.com/apps/51549/splunk-app-for-network-monitoring-and-mapping-beta It provides the ability to map your network devices (switches, routers, servers etc) on a rack image, world map or even a blank background and then pull it into Splunk. By pulling it into Splunk you can then drilldown on individual devices to see layer 2 and 3 information including any related log data. ... View more

You are best off pulling samples of each and using the wording on the events, and your resulting knowledge of what fields are populated in your particular environment, to pull information off the events via rex. The standard general wording for each is here, but it occasionally varies based on specific OS version. https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=642 https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4738 For instance, this pulls the Target account name off of the standard 528 and the 4738 events, respectively. Since the words "Account Name" occur twice, you need to take the second occurrence as the target account. This is one way to do that. | rex "Target Account Name:\s+?(<TargetName>[^\s]*)" | rex "Account Name:\s+?(<AccountName>[^\s]*) max_match=2 | eval TargetName=coalesce(TargetName,mvindex(AccountName,1)) ... View more