deploymentclient.conf
[target-broker:deploymentServer]
targetUri = splunk.domain.com:8089
outputs.conf
[tcpout]
server = splunk.domain.com:8089
[tcpout-server://splunk.domain.com:8089]
inputs.conf
[default]
host = MYPC257
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
[WinEventLog://Security]
index=security
current_only=1
evt_resolve_ad_obj=0
renderXml=1
disabled=0
Logon Failures
index=windows
LogName=Security EventCode=4625 | table _time, Workstation_Name, Source_Network_Address,
host, Account_Name
Monitor for Administrative and Guest Logon Failures
index=windows
LogName=Security
EventCode=4625 (Account_Name=_administrator OR Account_Name=guest) | stats
count values(Workstation_Name) AS Workstation_Name,
Values(Source_Network_Address)
AS Source_IP_Address,values(host) AS Host by Account_Name | where count > 3
deploymentclient.conf: if splunk.domain.com
is running the deployment server, then splunk.domain.com:8089
is probably correct. 8089 is the default management port.
However, port 8089 is probably wrong for outputs.conf. You need to find out the receiving port that is configured on splunk.domain.com
. Often, 9997 is used, but there is no default. You need to replace the 8089 with the proper port number everywhere in this file.
I have no idea if the inputs.conf or the searches are correct.
deploymentclient.conf: if splunk.domain.com
is running the deployment server, then splunk.domain.com:8089
is probably correct. 8089 is the default management port.
However, port 8089 is probably wrong for outputs.conf. You need to find out the receiving port that is configured on splunk.domain.com
. Often, 9997 is used, but there is no default. You need to replace the 8089 with the proper port number everywhere in this file.
I have no idea if the inputs.conf or the searches are correct.