All Apps and Add-ons

Windows Access And Changes not Working

bowmanja
New Member

It appears that the Windows Access And Changes not Working properly. It continuously says populating at the bottom of the dashboard. Does anyone have recommendations to fix this?

0 Karma

igifrin_splunk
Splunk Employee
Splunk Employee

Does the panel named Host Authentications Map say Populating... under the Source Hosts and Destination Hosts multi-select fields?

If that's the case, the search populating the list of hosts is running too long for some reason - try running that search on its own over a 7-day period:

| tstats prestats=true summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.app=win* by Authentication.src 
| stats count by Authentication.src

It's the search that populates the multi-select fields. It expects Authentication data model to be accelerated.

The next InfoSec app update will include some minor changes to this dashboard panel but please share additional details like the Splunk version, whether the search above produces a list of machines/IPs and whether the rest of the reports on the dashboard show data. This way it will be easier to pinpoint what happens in your setup and potentially prevent this happening in the next app update.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...