I have 40 Windows 2012 domain controllers (forwarding through heavy forwarders to cloud), that intermittently stop sending  "WinEventLog:Security" events to cloud indexers. In some cases, one of the servers will send Security events for a few hours and then stop sending altogether. I know the events exist on the server because I can see them through Event Viewer. On the other hand, I don't have the same issue with the Application or System events. They flow all the time. The issue only happens with "WinEventLog:Security" events. So far, I have tried to split the load among 4 heavy forwarders, thinking it was a forwarder congestion issue. I also configured the domain controllers to send directly cloud, bypassing the heavy forwarders. Alas, no success.  Has anyone experienced or heard about this issue? Thank you. ... View more

Hello. I'm trying to identify a pool of windows hosts by adding an additional field to the events they forward. I can do this by adding an inputs.conf in /Splunk_home/etc/system/local and this works. My metadata field is called uf_deployment::remote_laptop(see below). [monitor://C:\Windows\System32\winevt\Logs\Application.evtx] index = my_index disabled = 0 sourcetype = XmlWinEventLog _meta = uf_deployment::remote_laptop However, the only way I can see how to do this is by monitoring a log file and using the [monitor] tag. But this presents a problem; I don't want to forward events from a log that I'm not interested in, nor do I want to duplicate events. I'm looking for a solution that will allow me to send the _meta = uf_deployment::remote_laptop field without having to "monitor" a log file. So far I have tried [default] with no success(see below) Any help is appreciated. Thank you. [default] index = my_index disabled = 0 sourcetype = XmlWinEventLog _meta = uf_deployment::remote_laptop ... View more

Hi Team. I have a splunk query with a list of IP addressses(Client_IP). I also have a lookup file with the IP ranges(cidr_match) which also has a location(location) fields pinpointing a location of that IP address. How can I build a report using my query of IP addresses with the location information off of the lookup file? ... View more

I'm using my on-prem DS to push out apps to my UFs. The current cert has expired, how can I push a new cert to my UFs? I see that in my DS, I have a directory /opt/splunk/etc/deployment-apps/100_splunkcloud/default/. In this directory I have a server.pem file with last year's date. Is this where I need to move the new pem file? I thought it was in the /opt/splunk/etc/deployment-apps/100_splunkcloud/local directory instead.    Thank you! ... View more