Ok so basically for my current query it fetches the same process name and its change of state, like from Running to Stopped or Stopped to Running... First picture shows the changing state of time which is the newer event... But however, when I click on that event and click View events.... It actually shows the old raw event which is the Running state like in the second picture... How do I make it so that the clicking of View events will show the new raw event which is the Stopped state? ... View more

How do you whitelist services you wish to monitor and not forward redundant ones to the Splunk Server.... I've done before on WinEventLog but however not sure how to use WinHostMon or WMI to whitelist, will apperciate if someone has working configuration that whitelist/blacklist services ... View more

I've been tasked to forward logs from Windows NT to Splunk Enterprise however, there is no Syslog inbuilt for Windows and also no Splunk Universal Forwarder. Any idea how I should approach to this for corporate use? ... View more

Image attached is the following log I wish to forward but however I want to detect ONLY newly added Cronjobs (only the first same entry of each command), I've done it on Splunk Enterprise after these are forwarded but however, Splunk Server will keep receiving these events non-stop at the back end even if I filter it on the Splunk Server side since Cronjob is always running, I wish not to index data that I am not using before forwarding it to Splunk Server, how do I go about attempting this with props.conf or transform.conf. At the end of the day, there will be many different Cronjobs, but I want to uniquely identify them by once and only the first one of each just by looking at the CMD parameter in the brackets () ... View more

[WinEventLog://Security] disabled=0 start_from=oldest current_only=0 evt_resolve_ad_obj=0 checkpointInterval=5 whitelist1=528, 529, 538, 592 ,593, 624, 630, 636, 637, 513 index = winsecurity renderXml=false Above is my configuration in inputs.conf. I suppose evt_resolve_ad_obj is to prevent any resolving of GUID etc? But however it doesn't work! How do I fix this, this is for Windows XP. Left is the intended result I want it to be shown on Splunk but however it was converted which is what I do not want. ... View more

I have already appended my Splunk IP Address and UDP port in /etc/syslog.conf "(asterisk).(asterisk) (asterisk)192.168.0.1/9995", restarted syslog service too. At the Splunk side, I also added a new data input UDP, to accept 9995 and restrict the host to only the CentOS machine which is 192.168.0.59 (ip of my centos) but to no avail, no data was sent to Splunk... There is connection between two, checked via ping. ... View more

I am trying to use the latest "Value" from the last Added/Updated Registry Key but however it took in the oldest result instead... How do I fix this? My query: index="winauto" | eval _time = strftime(_time,"%d-%m-%y %H:%M:%S") | where (registry_type="SetValue" AND data!="") OR registry_type="DeleteKey" | eval Data=if(data="", "NA", data) | eventstats last(Data) as latestdata by key_path | eval Data=if(Data="NA", latestdata, Data) | eval Action=if(registry_type="SetValue", "Added/Updated Registry Key", "Removed Registry Key") | where Data != "NA" | table _time, Action, key_path, Data | rename key_path AS "Key" Data AS "Value" _time AS "Time" My intended result should be "TestData oh" in the first row but however it took in the oldest data which is "TestData" ... View more

To test this, I tried Control Panel > User Accounts > Change Account Type to and fro Standard account and Administrator account but no logs were produced from it.. Does not seem to log. ... View more

As stated in the question, my props.conf has the following settings: [daemonforCent] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE=false And as you can see, the result is still the same, not breaking anything. I've tried BREAK_ONLY_BEFORE=\r\n too but also will not work. ... View more