Same problem here - the permissions are set to Global for the app-permissions. My data is from Applocker Wineventlog imported using renderxml=true ... View more

We are running 2500 + on a single DPL, never goes above 5% CPU / 3gb ram phoneHomeIntervalInSecs = 600 ... View more

Q: When I replace pan_logs queries with index=pan_logs, some of my search queries work; but not dashboards. A: Look at that search' verbose hits - in what index does the data hide? Q: pan_traffic queries work, however "Traffic Dashboard" yields no data. A: (Look at the "traffic dashboard" search (Click the magnifyer) - what does the string say?) Q: pan_url queries work, however "URL Filtering Dashboard" & "Web Activity Report" yields no data. A: What i would recommend is ignoring all the field/extration shit and just search your environment for "sourcetype=pan*" for the last 30 days. Then look at what index/sourcetype it really has. This is an important part of your setup. Most likely you are not recieving any data or you are missing tranforms.conf/props.conf for the data ... View more

| rex max_match=0 "Step=(?<a_Step>([0-9]{5}))" This puts all the "Step" values in one field called "a_Step" Next task is to lookup the a_Step-values in a .cvs-file and properly present the info to a user | lookup my_csv_lookup "Message Code" AS a_Step OUTPUT Category When using the search app and applying the rex+lookup the "Category" field now lists the Category for each Step in the right order. Next task at hand is to figure out how to best present this to the users accessing the data ... View more

Thanks for the input - it got us on the right track:) ... View more

This doesnt answer why its enabled by default tho.. ... View more

But are you sure there are any non-benign files? ... View more

The dashboard shows "Last 60 minutes" - hit the "Open in search" button and change to a larger scope - you may not have any Malicious files in the logs for the last hour ... View more

The links does not help and i have the same question. My problem: I created a new role - added a few capabilites and saved it. Now suddenly the following capabilities are added "magically" to the new role: edit_win_admon edit_win_eventlogs edit_win_perfmon edit_win_regmon edit_win_wmiconf list_pdfserver list_win_localavailablelogs I can't find out where they are comming from (what makes splunk add this set of capabilities to my new role, even when i remove thenm) Also, i have posted my problem in a new ticket: http://answers.splunk.com/answers/306855/after-creating-a-new-role-why-are-a-set-of-capabil.html ... View more

Same error here. Splunk 6.2.3 (264376) on Windows. ... View more

I am also in a "Searching and Reporting " session (Self paced) and i also get this error ... View more

My guess is that the application containing the props.conf needs different permissions (App-permissions -> Global) ... View more

Check the PA Box Logs - if it logs it the same way this cannot be solved within Splunk. ... View more

When i run the query I get users listed. Try this: index=pan_logs user="*" | top 20000 user Run it "Last 60 minutes" or something This returns thousands of users for me - what does it list for you? ... View more

unknown means that USERID either is disabled or PA does not know what the user is. (That means that the PA itself should show you the same information - don't think its a Splunk-issue) ... View more

Indeed - no problem. ... View more

Should have answered as an answer and not a comment 😛 We deploy 6.1.4, with the following "Advanced Deployment Options Settings", it may be of help: Ignore language when deploying this package; Enabled Make this 32-bit X86 application available to Win64 computers; Enabled Include OLE class and product information; Enabled ... View more

We use an .mst with Property -> AGREETOLICENCE=YES DEPLOYMENT_SERVER = deployserver:8089 Where do you store the .msi and .mst file? It may be unaccessable during logon/permissions etc but work OK when you run it manually as an admin perhaps? ... View more

We deploy 6.1.4, with the following "Advanced Deployment Options Settings", it may be of help: Ignore language when deploying this package; Enabled Make this 32-bit X86 application available to Win64 computers; Enabled Include OLE class and product information; Enabled ... View more

For me the solution was (and still is) to deleted the mongod.lock file and do a "Splunk restart" ... View more

I had this error on 1/10 index`ers - restarted splunk twice and it solved the problem ... View more