I ran into a similar issue, and there could be at least two reasons for this. Here is the search the wizard generates: index=* OR index=_* _sourcetype="WinEventLog" | where _sourcetype="WinEventLog" | head 100 1. The Ingest Sample Data wizard uses the "where" search command, which is case sensitive. So make sure the sourcetype case matches how it actually shows up in events.  WinEventLog is not the same is wineventlog. 2. The wizard also uses the _sourcetype field instead of the sourcetype field. That means that if there is any sourcetype transformation happing already, the _sourcetype field will have the original sourcetype. You can check this by searching for your events and adding this _souredcetype field (which is normally hidden). index=* sourcetype="winEventLog" | head 100 | eval orig_sourcetype=_sourcetype   Patrick ... View more

We just upgraded from 7.1.x to 7.2.5.1 and we have noticed a similar behavior. Previously 20 15 1-7 * 3 would fire the first Wednesday of the month at 15:20. It is now firing every Wednesday AND the first seven days of the month at 1520. I don't see any release notes with 7.2 about cron changes, but it seems there was some change. ... View more

It's a Festivus Miracle! sa-ldapsearch 2.2.0 was released on 1/3/2019 and it is based off of ldap3 v2.5, and it seems to have resolved the slowness issue! Go download it now! ... View more

For us it seems 7.1 has broken the |makemv solution, and removing it doesn't help. I cannot get the sparkline to render if it is in the second part of the join. I was able to work around it by switching the order and having the sparkline before the join. ... View more

The LastLogon time stamp can vary from Domain Controller to Domain Controller as LastLogon is not replicated. lastLogonTimeStamp is replicated, but it is on a delay so this value will be 10-14 days behind. The main use for this field is to find accounts that are stale (i.e. >90 days old). https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/ ... View more

We have found that every so often (1-2 months) what we stop getting data from Security Center via the Nessus app. I haven't found the root cause, but I have found that if you change the Start Time in the Splunk_TA_nessus inputs for Security Center that it will start working again. ... View more

I was seeing the same behavior. Both resource_usage.log and disk_objects.log were not getting collected, so many DMC panels were blank (sometimes DMC can be tricky). I found that somehow we had two invalid props.conf entries in our _cluster app. To find this: In the splunkd.log, look for the log entry that proceedes the TailReader error you are seeing above, in our case we saw: `01-20-2017 13:04:38.063 -0500 ERROR IndexedExtractionsConfig - Invalid value='' for parameter='INDEXED_EXTRACTIONS'. 01-20-2017 13:04:38.063 -0500 ERROR TailReader - Ignoring path="C:\Program Files\Splunk\var\log\introspection\resource_usage.log.3" due to: Invalid indexed extractions configuration - see prior error messages Notice the invalid parameter is INDEXED_EXTRACTIONS and it claims we have a value of ''. 2. On one of your peer indexers, run the following command. You may want to redirect the output to a file to make it easier to view. splunk btool props list --debug 3. In the output from above, find the line where the invalid parameter is set. In your case as in ours it should be under heading [splunk_resource_usage] and [splunk_disk_objects] 4. Once you find the line, it should point you to the config file that has the bad value. In our case this was in etc\slave-apps\_cluster\local\props.conf, so we just fixed the copy of this file in the master-apps on the cluster master and redistributed the cluster bundle. For some reason we had the following 4 lines in this file: [splunk_disk_objects] INDEXED_EXTRACTIONS = [splunk_resource_usage] INDEXED_EXTRACTIONS = We removed all four lines. 5. The change did not cause the indexers to restart, so I had to manually run a rolling restart splunk rolling-restart cluster-peers`. Once the peers restarted, the all the panels that rely on these logs started to render data. Hope this helps, Patrick ... View more

In my case when using the DBConnect 2.3.1 and MS Generic driver, I had to edit the JDBC URL format to omit the :<port> tag, leaving it as: jdbc:sqlserver://<host>;databaseName=<database>;selectMethod=cursor You can do this within the connection screen. Then you can specify the Server field as <servername>\<instancename> , as you normally would for named instances. ... View more

Is there anyway to specify the same range when using the sparkline function in a search? We are embedding the report, so I can't use a dashboard. Thanks! ... View more

This issue makes me a very sad panda. I've had a case open with support since 12/2015 for this issue. They acknowledged that it is an issue they are working on, but still no fix. The problem started with v2 of the add-on. If you go back to the v1 version, which is Java based:-(, the performance is on par with normal LDAP queries. The downside, beyond Java, of downgrading to v1 is that there are lots of features missing. Namely Non-ASCII character support and ability to specify a BaseDN. Going back to v1 broke apps that we use and have created so we are back on slow v2. We try to use scheduled reports as much as possible to hide the slow searching, but that is not ideal, especially for developing searches. ... View more

It seems this is a bug with DBConnect when the py_health.log hits 10,000KB. We noticed the same thing and stopping splunkd, renaming the file and starting splunkd solved the issue. https://answers.splunk.com/answers/319066/why-is-the-splunk-db-connect-205-health-dashboard.html ... View more

Exactly what I was looking for, thank you! ... View more

I had an issue getting the Reputation script to run as well. I found that the slashes in the input.conf withint the TA-SMPT-Reputation app were forward slashes and on my windows box I had to change them to back slashes. Note that the first two don't change. Was [script://./bin/check_my_reputation.py] changed to [script://.\bin\check_my_reputation.py] ... View more