Good Afternoon, Some brief background for the longest time we have been using Splunk as a Standalone Indexer and search head combined. In its infancy it was on a physical server and it worked great. Then Virtualised environments came along and it was transfered into VMware. Since then its been pretty bad, We have had all manner of "consultants" try and figure out why the searching is so slow but nobody really can figure it out. The actual question I have come full circle and have managed to source a brand new HP DL360 Gen10 but I wondered should i be using this for the indexing or for the search head?   ... View more

Hi if someone could please help that would be great, I have events showing up in the indexer that are pushing me over my license, alot of it is useless to me information and i have been trying to wrap my head around filtering it out using regex but i just cant get my head around it.  Below is a typical event i would like to rid my indexer of, i cant just block all the events with 4634  as some of them are valid, but i would like to block all events where the "Targetusersid" is similar to DOMAIN\ABC-12345$   Can anyone help <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4634</EventID><Version>0</Version><Level>0</Level><Task>12545</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2021-02-12T08:24:29.977950700Z'/><EventRecordID>314243098</EventRecordID><Correlation/><Execution ProcessID='852' ThreadID='12388'/><Channel>Security</Channel><Computer>domaincontoller.domainname</Computer><Security/></System><EventData><Data Name='TargetUserSid'>DomainName\machine-name$</Data><Data Name='TargetUserName'>Machine-Name$</Data><Data Name='TargetDomainName'>DomainName</Data><Data Name='TargetLogonId'>0x22b9251d</Data><Data Name='LogonType'>3</Data></EventData></Event> Props.conf  [XmlWinEventLog:Security] TRANSFORMS-xml = xmlnull REGEX=(?m)^EventCode="(4662|566)" Message="Object Type:(?!\s*groupPolicyContainer)" REGEX=(?m)^EventCode="(4656|4670|4663|4703|4658|4688)" Message="Account Name:(\W+\w+$)" REGEX=(?m)^EventCode="(4688|4689)" Message="%SplunkUniversalForwarder%" REGEX=(?m)^EventCode="6278" Message="Network Policy Server granted full access to a user because the host met the defined health policy." REGEX=(?m)^EventCode="(4624|4634|4627|4648)" Message="Account\sName:.*[\S\s]*Account\sName:\s+[\S+]+[\$]" Transforms.conf [xmlnull] REGEX= NO idea 😞 DEST_KEY = queue FORMAT = nullQueue   ... View more

Can someone tell me if when you change settings on a deployed app in your deployment server if the changes are propogated to the servers the app is deployed on or is there another step needed. ... View more

I have this search which shows the total of bytes coming in for a particular time period. Can someone tell me how to change the search so i can have the value changed to MB? I understand i should maybe be using the eval function but, try as i might, i can't seem to get the output i want. sourcetype="microsoft:forefront:tmg:proxy" | stats Sum(sc_bytes) ... View more