Hello. I'm struggling with a query. We want to search Windows Event logs for accounts whose passwords have not been changed (by admins) for more than 700 days. I have created a query that informs me of when a password was changed: index=main host=*DC* EventCode=4724 | eval Modifier = mvindex(Account_Name, 0) | eval User_Name = mvindex(Account_Name, 1) | rename Group_Name AS Modified_Group | table _time Modifier User_Name But I do not know how to get Splunk to check for a password that has NOT been changed for over X days. Is this even possible? Thank you in advance for your help. ... View more

Hello. We have tabular data formatted like this: "CollectionName" "CollectionSize" "PercentageUsed" "FOO" "36" "50" "BAR" "14" "36" (The first row is the column headers, translated into field names.) We are trying to create a dashboard containing pie charts like this: For each CollectionName, create a pie chart labeled with "CollectionName" that contains the value of field "CollectionSize." Within that pie chart, we want a wedge for the "PercentageUsed" field. So if "PercentageUsed" field is "50" (%) of CollectionSize, it would split the pie chart in half. If it's "20" (%) of CollectionSize then the pie chart would have a wedge that is 20% of the chart's size. We'll eventually want to be able to click on that wedge to drill down, but we'll tackle that later. We'd like the dashboard to show a pie chart for each CollectionName. I think I'm close. I can get it to create a single pie chart for one CollectionName. index=foo sourcetype="foo-usage" CollectionName=FOO | stats count by CollectionSize,PercentageUsed | transpose That will show a single pie chart for the CollectionName "FOO." How do we get a pie chart for each CollectionName on the dashboard? Thanks! Update: I am able to get pie charts for each CollectionName with the PercentageUsed on top: index=vdiclinics sourcetype="vdi-usage" | stats count by PercentageUsed,CollectionName and using Trellis (finally got that to work). That's okay, but I'd like PercentageUsed to be a wedge, not a label. Here's what I have right now for one Collection: How can I accomplish this? Thank you! ... View more

Hi. At Splunk's recommendation, I have a centralized syslog server (using rsyslog) that writes to /logs/hostname/year/month/day/file.log This works fine. However, I cannot get the Universal Forwarder to send the events to the Splunk Indexer. I added my stanza to /opt/splunkforwarder/etc/system/local/inputs.conf. When that didn't work, I created an app and put the stanza into /opt/splunkforwarder/etc/apps/syslog/local/inputs.conf Didn't work. Here is my stanza: [monitor:///logs/*] disabled = false host_segment = 2 index = main sourcetype = syslog That looks straightforward to me. I checked the Splunk logs on the Indexer and there's no sign that it's ever receiving these events. In the UF logs I see that it has added a watch to /logs: INFO TailingProcessor - Parsing configuration stanza: monitor:///logs/*. INFO TailingProcessor - Adding watch on path: /logs. I have verified that the port is open between the UF and the Indexer. Indexer is running 7.2.4 and UF is running 7.1.2. Am I missing something? Thank you in advance! ... View more