Hi, In order to understand which props.conf to be configured, it is important to understand the data pipeline, please refer to this link for more information: https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Configurationparametersandthedatapipeline And to answer your question, if your Splunk architecture only has a Splunk UF installed on your syslog-ng and forward logs directly to Splunk indexer, you will need to configure your timestamp configuration in the indexer's props.conf. In certain situations, if you apply the INDEXED_EXTRACTIONS in your Universal Forwarder's props.conf, you will need to configure timestamp extractions on the same props.conf on UF as well. If your UF is forwarding data to a Heavy Forwarder before forwarding to the indexer, you will need to configure timestamp configurations on the HF's props.conf. Lastly, please review your timestamp configurations for the firewall sourcetype. These are the configurations used for timestamp extractions: - TIME_PREFIX - TIME_FORMAT - MAX_TIMESTAMP_LOOKAHEAD - TZ - DATETIME_CONFIG Hope it clears your doubts! Regards, Benjamin ... View more

Hi, In order for dashboards under Active Directory section to work well, you will need to install additional Add-On namely the Splunk Add-on for Microsoft Active Directory and Splunk Add-on for PowerShell. You might need the Splunk Add-on for Windows DNS if you are interested in collecting DNS related logs. You can follow the official documentation here to help you: https://docs.splunk.com/Documentation/MSApp/1.4.2/MSInfra/AbouttheSplunkAppforMSInfrastructure Regards, Benjamin ... View more

Did you manage to resolve this? I am currently facing the exact issues as described above. Please let me know if you manage to find a solution to this! Thanks in advance! ... View more

Hi, Thanks for your suggestion! I ended up using Optiv Threat Intelligence App, althought still in the middle of configuration and troubleshooting for the app but it's a good start! Once again, thank you. 🙂 Regards, Benjamin ... View more

Alright, I will check it out and see if I can have any breakthrough from there! Thank you so much! 🙂 ... View more

Hi Mikael, Thank you so much for your swift reply! How about the ACL? Is it part of the switches configuration? Regards, Benjamin ... View more

Hi, Not sure if this would work but you could try: SELECT DateCreated, DateSent, DateResponseCollected, ResponseCode FROM "Commissions"."disbursements"."HyperWalletFiles" WITH (NOLOCK) Hope it helps! Regards, Ben ... View more

Hi robnewman666, The reason the SPWeb rebuilder stop there is because there's a mistake in the SPL. If you have enough permission to access the configuration files, navigate to /$SPLUNK_HOME/etc/apps/Splunk_for_Sharepoint/local to create or modify the savedsearches.conf. Look for the stanza [Lookup - SPWeb] and paste the following: search = eventtype=mssharepoint-inventory Type="Web" | stats latest(_time) as _time, latest(Action) as Action, latest(Title) as Title, latest(SiteId) as SiteId, latest(AllowAnonymousAccess) as AllowAnonymousAccess, latest(AllowAutomaticASPXPageIndexing) as AllowAutomaticASPXPageIndexing, latest(AllowRssFeeds) as AllowRssFeeds, latest(AllowUnsafeUpdates) as AllowUnsafeUpdates, latest(AllWebTemplatesAllowed) as AllWebTemplatesAllowed, latest(AlternateCssUrl) as AlternateCssUrl, latest(AlternateHeader) as AlternateHeader, latest(ASPXPageIndexer) as ASPXPageIndexer, latest(ASPXPageIndexMode) as ASPXPageIndexMode, latest(AuditFlags) as AuditFlags, latest(UseAuditFlagCache) as UseAuditFlagCache, latest(EffectiveAuditMask) as EffectiveAuditMask, latest(AuthenticationMode) as AuthenticationMode, latest(Author) as Author, latest(ClientTag) as ClientTag, latest(Configuration) as Configuration, latest(Created) as Created, latest(CurrencyLocaleID) as CurrencyLocaleID, latest(CustomJavaScriptFileUrl) as CustomJavaScriptFileUrl, latest(CustomMasterUrl) as CustomMasterUrl, latest(CustomUploadPage) as CustomUploadPage, latest(EffectivePresenceEnabled) as EffectivePresenceEnabled, latest(EmailInsertsEnabled) as EmailInsertsEnabled, latest(EventHandlersEnabled) as EventHandlersEnabled, latest(ExecuteUrl) as ExecuteUrl, latest(Exists) as Exists, latest(HasExternalSecurityProvider) as HasExternalSecurityProvider, latest(HasUniquePerm) as HasUniquePerm, latest(HasUniqueRoleAssignments) as HasUniqueRoleAssignments, latest(HasUniqueRoleDefinitions) as HasUniqueRoleDefinitions, latest(IncludeSupportingFolders) as IncludeSupportingFolders, latest(IsADAccountCreationMode) as IsADAccountCreationMode, latest(IsADEmailEnabled) as IsADEmailEnabled, latest(IsMultilingual) as IsMultilingual, latest(IsRootWeb) as IsRootWeb, latest(Language) as Language, latest(LastItemModifiedDate) as LastItemModifiedDate, latest(Locale) as Locale, latest(MasterPageReferenceEnabled) as MasterPageReferenceEnabled, latest(MasterUrl) as MasterUrl, latest(NoCrawl) as NoCrawl, latest(OverwriteTranslationsOnChange) as OverwriteTranslationsOnChange, latest(ParentWeb) as ParentWeb, latest(ParserEnabled) as ParserEnabled, latest(PortalMember) as PortalMember, latest(PortalName) as PortalName, latest(PortalSubscriptionUrl) as PortalSubscriptionUrl, latest(PortalUrl) as PortalUrl, latest(PresenceEnabled) as PresenceEnabled, latest(Provisioned) as Provisioned, latest(PublicFolderRootUrl) as PublicFolderRootUrl, latest(QuickLaunchEnabled) as QuickLaunchEnabled, latest(RecycleBinEnabled) as RecycleBinEnabled, latest(RequestAccessEmail) as RequestAccessEmail, latest(RequestAccessEnabled) as RequestAccessEnabled, latest(RootFolder) as RootFolder, latest(ServerRelativeUrl) as ServerRelativeUrl, latest(SiteLogoUrl) as SiteLogoUrl, latest(SyndicationEnabled) as SyndicationEnabled, latest(Theme) as Theme, latest(ThemeCssUrl) as ThemeCssUrl, latest(ThemeCssFolderUrl) as ThemeCssFolderUrl, latest(TreeViewEnabled) as TreeViewEnabled, latest(UIVersion) as UIVersion, latest(UIVersionConfigurationEnabled) as UIVersionConfigurationEnabled, latest(WebTemplate) as WebTemplate, latest(WebTemplateId) as WebTemplateId by FarmId,Id | where Action != "Delete" | outputlookup SPWeb The error is due to an extra latest(Title) as Title in the stats command. However, this does not solve the SP13inventory issue still unfortunately... Regards, Benjamin ... View more

Hi hunters, The instructions on the app page does not provide much help in troubleshooting this issue to be honest, my team and I have been tracking this questions for half a year now. Did you manage to configure it to work properly on your end? It would be a great help if you could share your experience in this SharePoint App and Add-On! Looking forward to hear back from you! 😄 Regards, Ben ... View more

Hi Jack, This is none related to the question itself, but I am facing an issue with the sp13audit.exe that is being packaged inside Splunk Add-On for Microsoft SharePoint and there seems to be no fixes online. Would you mind sharing the source code of the exe file if it's not too much of a trouble? We are really trying to get the app up and running. Really appreciate if you could lend a helping hand. Thanks! And sorry for the none related post again! ... View more

Anyone out there has a solution for this?? Facing the same issue as well.. ... View more

Hi, Not sure if this is related, we did face an issue with one of the Administrator Audit panels under the Active Directory section: Administrator Logons. After troubleshooting, we discovered part of the search was incorrect which leads to inaccurate results return. The default search for the panel is as below: eventtype=msad-successful-user-logons dest_nt_domain="$select242$" user="$select244$"|rename src as src_ip|`ip-to-host`|`fix-localhost`|lookup SiteInfo host|dedup consecutive=t Site,src_nt_host,src_ip|table _time,Site,src_nt_host,src_ip|rename src_nt_host as Workstation,src_ip as "IP Address" Just remove the |rename src as src_ip and the panel should return the proper result. Hope this help! ... View more

Please refer to this post: https://answers.splunk.com/answers/421889/how-can-we-exclude-weekends-from-the-count-of-the.html Hope it helps! ... View more

You can install the Windows TA onto the Universal Forwarder and modify the inputs.conf using whitelist or blacklist depending on the usage. At least thats what I did. Hope it helps! ... View more

Thanks a lot! Hopefully they get back to you soon! It seems this particular dashboard is having issues since few years back and somehow it was never solved. ... View more

Have you send a ticket to Splunk yet? Did they respond you with any solutions? I am facing the same issue as well. ... View more

Just a thought, does adding maxspan and maxpause help? ... View more