Agree that it's microsoft issue, however Splunk when implemented the way of ingesting as Xml, certain fields should have been tokenized, or provide lookup for translation. Leaving this on the user community to implement was a poor choice on Splunk part... Furthermore, leaving tab delimiter in place should not have been allowed... Now I have to create means to dealing with this on my own. See below link for more info... https://social.technet.microsoft.com/Forums/windows/en-US/0ec39516-5dcc-4453-9761-c1f94439a1cc/windows-7-security-audit-logs-how-do-i-translate-4421-1537-and-other-xxxx-data-fields?forum=w7itprosecurity ... View more

It's not the authorized.conf. ess_user, ess_admin, ess_analysts would have been additional roles associated with admin account or other users defined local to the splunk (i.e. if you are using LDAP, then only system accounts that should be defined would have been admin). Look at the $SPLUNK_HOME/etc/passwd. remove the roles associated that is no-longer existing on that splunk instance. That should get rid of the errors in the log. :admin:$$::Administrator:admin;ess_admin;ess_analyst:changeme@example.com:: In above example, remove the entries ';ess_admin;ess_analyst' and save. Restart splunk, and error will be gone. ... View more

fire_brigade v2 does not have "Update monitor list from REST" saved search. fire_brigade v1 has this particular saved search. Either case requires some adjustments especially if you have distributed / clustered environment with multiple indexers (peers). The rest API /services/data/indexes does not allow multiple peer hosts as valid entries. So you would need to run on each indexers, then append the results, dedup it and save it as csv file. Since clustered, there should not be any deviation in indexes present in one versus another peers; however why leave it to chance. Create a saved search "Update monitor list from REST" in the context of fire brigade app, save it and have it scheduled to run in some cycle (monthly, weekly, or daily ... go nuts). Below is how I did it in our environment. I have 10 peers, so run rest API against each indexers, then append the results, then due some filter, dedup, then save as csv as expected by fire brigade app. | rest /services/data/indexes splunk_server=idx01 count=0 | append [| rest /services/data/indexes splunk_server=idx02 count=0 ] | append [| rest /services/data/indexes splunk_server=idx03 count=0 ] | append [| rest /services/data/indexes splunk_server=idx04 count=0 ] | append [| rest /services/data/indexes splunk_server=idx05 count=0 ] | append [| rest /services/data/indexes splunk_server=idx06 count=0 ] | append [| rest /services/data/indexes splunk_server=idx07 count=0 ] | append [| rest /services/data/indexes splunk_server=idx08 count=0 ] | append [| rest /services/data/indexes splunk_server=idx09 count=0 ] | append [| rest /services/data/indexes splunk_server=idx10 count=0 ] | search disabled=0 title!=_blocksignature title!=_thefishbucket | rename title AS index | fields index | dedup index | outputlookup monitored_indexes.csv Hope this helps others in upgrading fire brigade (very useful app... but Splunk being Splunk often makes assumptions that is not always true)... ... View more