You can keep the 6.4 UF's for some more time. Or, as I remember on some other posts here, maybe, UF 6.5 will get installed on Windows 7. The only issue is, the official support from splunk won't be available. ... View more

Those are two entirely different stanzas so they do not impact each other. Adding a new stanza to etc/system/local will only modify pre-existing stanzas if the stanzas are the same. For example if you added a stanza like [WinEventLog://Security] disabled = 1 to etc/system/local this would override your deployment client's inputs.conf and effectively disable the collection on that box. ... View more

I think you could write and deploy a simple scripted input to just run "ipconfig /all" and index the results. May take some scripting to get it into a nicer format, but I honestly don't think this capability already exists in the Windows TA. ... View more

FYI, Fire Brigade version 2 will no longer be updated (latest version is 2.0.3). The newer versions 2.0.4 and higher will now be available with the original “Fire Brigade” app on Splunkbase which was just updated to support Splunk 6.3. This is noted on the page for Fire Brigade on Splunkbase: https://splunkbase.splunk.com/app/1581/ If you have any questions, ping the developer of the app @sowings Cheers! ... View more

I appreciate all the answers here that I have used in my tasks. In addition to above, there is one more thing to check: ACL entries of account that runs forwarder on RH (or SEL). If nothing works above, this is a good thing to check and add necessary config. ... View more