This eventcode is only for group change, i need something for GPO. ... View more

The logs are already forwarded to splunk, but i really need to create an alert when a GPO is modified, created etc. Is there a way to do it? ... View more

Didnt work. ... View more

Not working, here is the logs: https://pastebin.com/3Z5pmzCs Could you please help me understanding it? ... View more

Doesnt work.. ... View more

https://pastebin.com/iBN3aLV2 ... View more

Yes. Pastebin log ... View more

Yes link text ... View more

After i log with my credentials i get an "500 Internal Error" doesnt matter the username. ... View more

Still same problem. bin]# ./splunk start Splunk> The Notorious B.I.G. D.A.T.A. Checking prerequisites... Checking http port [10.244.161.7:8000]: open Checking mgmt port [10.244.161.7:8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [10.244.161.7:8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _telemetry _thefishbu cket checkfwd eqalis_network_sample firewall history itau main mwg_audit os osse c perfmon snort_cardholder snort_servidores sos sos_summary_daily summary summar y_forwarders summary_hosts summary_indexers summary_pools summary_sources summar y_sourcetypes syslog tp_win_sec tp_win_servers windows wineventlog Done Bypassing local license checks since this instance is configured with a remote l icense master. Checking filesystem compatibility... Done Checking conf files for problems... Improper stanza [dhcpd_server_dhcprelease] in /opt/splunk/etc/ap ps/unix/default/tags.conf, line 30 Your indexes and inputs configurations are not internally consis tent. For more information, run 'splunk btool check --debug' Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-6.6.3 -e21ee54bc796-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done [ OK ] Waiting for web server at https://10.244.161.7:8000 to be available... Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at https://10.244.161.7:8000 ... View more

All users on the same splunk indexer are experiencing the error, the others with older enterprise version have no problem. What can be causing it? The server only runs splunk enterprise. ... View more

http doesnt work, only https. The error occur after i login with my credentials. I dont know what to do. *> # ./splunk start Splunk> Now with more code! Checking prerequisites... Checking http port [10.244.161.7:8000]: open Checking mgmt port [10.244.161.7:8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [10.244.161.7:8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _telemetry _thefishbu cket checkfwd eqalis_network_sample firewall history itau main mwg_audit os osse c perfmon snort_cardholder snort_servidores sos sos_summary_daily summary summar y_forwarders summary_hosts summary_indexers summary_pools summary_sources summar y_sourcetypes syslog tp_win_sec tp_win_servers windows wineventlog Done Bypassing local license checks since this instance is configured with a remote l icense master. Checking filesystem compatibility... Done Checking conf files for problems... Improper stanza [dhcpd_server_dhcprelease] in /opt/splunk/etc/ap ps/unix/default/tags.conf, line 30 Invalid key in stanza [email] in /opt/splunk/etc/system/local/al ert_actions.conf, line 5: reportServerEnabled (value: 1). Invalid key in stanza [email] in /opt/splunk/etc/system/local/al ert_actions.conf, line 6: reportServerURL (value: ). Your indexes and inputs configurations are not internally consis tent. For more information, run 'splunk btool check --debug' Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-6.6.3 -e21ee54bc796-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done [ OK ] Waiting for web server at https://10.244.161.7:8000 to be available... Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at https://10.244.161.7:8000* ... View more