hello every body , How to search to correlate there use case please : Detection of access to basic hash files passwords, connections from multiple IPs to the same accounts, Unauthorized device on the network, Logs deleted from source Please ? I want a request in the general framework and I will try to adapt my data. Thank in advance. ... View more

Hello Splunk community Is Citrix NetScaler with AppFlow compatible with enterprise splunk version 7? ... View more

hello every body , someone know how to configure splunk for collect change auditor logs please ? Thansk in advance ... View more

Hello Everybody I installed the radius_auth application and I followed the procedure correctly. But when I try to log in with IDs radius it does not pass. I have this error message: Invalid username or password. But in parallel, I use Wireshark to capture logs from my Splunk to the radius server and I see that the request passes and is accepted. Can anyone tell me what is the problem? ... View more

Hello everyone I need some help. I use the radius application and I see the authentication of the latter with the server succeeded. while I can not log on splunk with my AD identifiers. the internal splunk logs are below. 2018-03-22 10:07:27,815 ERROR RadiusAuth - Exception triggered when attempting to contact the RADIUS server 10.1.2.25: 2018-03-22 10:07:27,815 INFO RadiusAuth - Authentication to primary RADIUS server failed 2018-03-22 10:07:27,816 INFO RadiusAuth - function=userLogin called, user 'df' authenticated action=fail, username=df 2018-03-22 10:07:29,999 ERROR RadiusAuth - Exception triggered when attempting to contact the RADIUS server 10.1.2.25: 2018-03-22 10:07:30,000 INFO RadiusAuth - Authentication to primary RADIUS server failed 2018-03-22 10:07:30,000 INFO RadiusAuth - function=userLogin called, user 'df' authenticated action=fail, username=df 2018-03-22 10:09:00,999 INFO RadiusAuth - The user info cache directory does not exist yet thank you in advance ... View more

hello Everybody When I open the dashboard, panels using basic search do not work, but if I open them in the search, I get the results I want. I will provide the XML. Why could it happen? Is there some kind of missing feature that prevents me from seeing the results in the dashboard or application even though I can see the correct results when the panel is open in the search? <search> <query>| pivot proofpoint proofpoint_search count(proofpoint_search) AS "Count of proofpoint_search" SPLITROW _time AS _time PERIOD auto SPLITCOL type3 FILTER type3 is "*" SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 0 </query> Thanks in advance. ... View more

hello , someone can help me to translate this pivot command in search command | pivot proofpoint proofpoint_search count(proofpoint_search) AS "count(proofpoint_search)" SPLITROW s_domaine SPLITROW ip_sender AS ip SPLITROW action AS action SORT 1000000 s_domaine ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1|table s_domaine ip action|search s_domaine!="NULL" s_domaine="$doamine$" ip!="NULL" ip="$ip$" action!="NULL" $status$|stats values(ip) as IPs values(action) as action count by s_domaine|rename s_domaine AS "Sender Domaine" |sort - count. thank you in advance ... View more

Hello everybody is it possible to add the application "splunk for linux" in a windows server? If yes ,How ? ... View more