Splunk Search

Being new to Splunk, do my inputs.conf and outputs.conf look correct on my local PC?

rsingh
Explorer

deploymentclient.conf

[target-broker:deploymentServer]
targetUri = splunk.domain.com:8089

outputs.conf

[tcpout]

server = splunk.domain.com:8089

[tcpout-server://splunk.domain.com:8089]

inputs.conf

[default]
host = MYPC257

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[WinEventLog://Security]
index=security
current_only=1
evt_resolve_ad_obj=0
renderXml=1
disabled=0

Logon Failures

index=windows 
LogName=Security EventCode=4625 | table _time, Workstation_Name, Source_Network_Address,
host, Account_Name

Monitor for Administrative and Guest Logon Failures

index=windows 
LogName=Security 
EventCode=4625 (Account_Name=_administrator OR Account_Name=guest) | stats
count values(Workstation_Name) AS Workstation_Name, 
Values(Source_Network_Address) 
AS Source_IP_Address,values(host) AS Host by Account_Name | where count > 3
0 Karma
1 Solution

lguinn2
Legend

deploymentclient.conf: if splunk.domain.com is running the deployment server, then splunk.domain.com:8089 is probably correct. 8089 is the default management port.

However, port 8089 is probably wrong for outputs.conf. You need to find out the receiving port that is configured on splunk.domain.com. Often, 9997 is used, but there is no default. You need to replace the 8089 with the proper port number everywhere in this file.

I have no idea if the inputs.conf or the searches are correct.

View solution in original post

0 Karma

lguinn2
Legend

deploymentclient.conf: if splunk.domain.com is running the deployment server, then splunk.domain.com:8089 is probably correct. 8089 is the default management port.

However, port 8089 is probably wrong for outputs.conf. You need to find out the receiving port that is configured on splunk.domain.com. Often, 9997 is used, but there is no default. You need to replace the 8089 with the proper port number everywhere in this file.

I have no idea if the inputs.conf or the searches are correct.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...