We already observed that behavior in multiple previous Splunk Universal Forwarder versions such as 7.3.3, 8.1.3, ... and it still occurs with version 9.0.4 as well (Faulting application name: splunk-winevtlog.exe). Servers with high event count generate more often AppCrash events (Event IDs 1000/1001) than servers with low event count. ... View more

Getting the same ERROR messages randomly on Windows 2016 servers with forwarders on 7.3.3. ... View more

You may take a look here: https://answers.splunk.com/answers/313032/how-to-apply-colors-of-a-choropleth-map-on-a-field.html Based on the answer of @TarlKudrick and the information in the other post, I could get the choropleth map display a legend of 9 custom ranges using the colors I wanted for each range. ... View more

I went for the solution: Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00] To make it work for my purpose, I had to use a case statement (https://answers.splunk.com/answers/666322/edit-legend-from-choropleth-map-chart.html) to first generate all the categories, then sort them from the lowest to the highest, so that it can match the color order in the mapping.seriesColors. 1: Less 100 would get 0x00FF00 (green) 2: 100 to 500 would get 0xFFFF00 (yellow) 3: Over 500" would get 0xFF0000 (red) Here a simplified example (as I had to do that for 9 categories...) | eval count=case(count<100, "1: Less 100", (count>=100 AND count<500), "2: 100 to 500", count>500, "3: Over 500") | sort +count | geom geo_countries featureIdField=country But honestly it's a pain. The proper way should be to be able to use sequential color mode and then be able to customize the data ranges for the legend. ... View more

The best is to exclude the contents of a specific Event ID directly from the Universal Forwarder. Using a Heavy Forwarder for that is not necessary anymore. Create an app to deploy and in the inputs.conf you can create multiple whitelist matching different regex. So you can filter out specific messages or fields within a specific Event ID. whitelist = | key=regex [key=regex] https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf , ... View more

Just upgraded from 6.x to 7.0.2, ran into the problem and the above workaround solved the problem. Thanks a lot ! ... View more

The solution posted here link text is the right one, even you're running on Windows. Let's assume your $SPLUNK_HOME folder is C:\Program Files\Splunk\ for example. Go to C:\Program Files\Splunk\etc\auth and check if the date of your certificate (server.pem) is still valid: openssl x509 -enddate -noout -in "C:\Program Files\Splunk\etc\auth\server.pem" If expired, go to C:\Program Files\Splunk\bin and run: splunk createssl server-cert -d "C:\Program Files\Splunk\etc\auth\server.pem" -n server -c YourDomain -l 2048 That will overwrite your "server.pem" and make it valid 1 more year. Restart Splunk and you should be fine. ... View more

Solved my problem on 6.5.2, as well as the detailed explanation here: link text ... View more

Hi, I've been struggling with the same question for a while. For example who changed a specific user attribute (we're talking about the data in the msad index, which come from splunk-admon). It looks like the Active Directory doesn't provide any "who changed" field. You can take a look at a discussion about it here: link text Actually that should be an enhancement to the next splunk AD app / Forwarder. I mean, maybe adding a feature to the forwarder to makes it possible to catch the identity of the person doing the changes, like other AD monitoring software also do. Does that answer your question ? ... View more

You could take a look here: http://answers.splunk.com/answers/43197/how-to-set-up-more-than-three-type-of-visualization-eg-single-value-or-radial-gauge-in-a-row ... View more

I can't test it right now, but if you remove "by _time" everywhere in the search, it should give you the count for Operation and the count Administrative, so that you just have to create a report and select pie chart. ... View more

You could try the "Splunk on Splunk" App, http://apps.splunk.com/app/748 It will provide you a good overview of what's happening on your indexer. ... View more

You could try something like this: index="MyIndex" EventCode="4625" | eval Username=(mvindex(Account_Name,1)) | stats count by Username,host | table Username,host,count Regarding "last login",you could simply do a search like: index="MyIndex" EventCode="4625" | eval Username=(mvindex(Account_Name,1)) | dedup Username | table _time,Username,host I guess combining "last login" with the count of failed events is a little bit tricky. You could try appending a search. ... View more

Are your indexers running under Windows ? What is the output from "splunk show cluster-bundle-status" ... View more

So you get the memory usage problem on both DCs over LAN and WAN, right ? When you perform a search targeting one of this DC, do you see a big time gap between the time you run the search and the timestamp of the last search results ? If yes, I'd say either the forwarder can't keep up with the events rate through the WAN, or the indexer can't keep up generally with the amount of incoming events. One of those bottlenecks could explain the huge memory usage ? ... View more

Are your DCs forwarding over LAN or WAN ? How many events are you indexing over a 24h time period / DC ? ... View more

It worked for me, on Splunk Search Head 5.0.2. ... View more

Hi, there's no universal app to do that. It depends on which systems you're working with. For example, in windows environment, the windows Technical Addons (TA) provides all necessary eventtypes. Take a look at the apps on Splunkbase, you'll find for sure an app providing you the eventtypes you need. ... View more