Maybe create a lookup of user ids that have been found as locked (with the date time found) and then when you find a user do a lookup match and only return events where the user isn't in the lookup and as a final step update the lookup with new users. ... View more

Throttling will control how often the email is sent. You will need to craft your search so that it detects new lockout events during the time range. Then you can set the alert criteria to alert if the returned event count > 0. ... View more

frozenTimePeriodInSecs will force your retention settings on your index. In this case you are correct that your settings will force the data to roll off after 6 months. ... View more

It is possible that when you ran the pip install command the azure-keyvault module got installed in the directories pertaining to the Linux system version of Python and not the Splunk version of Python. When I have needed modules that aren't in the Splunk Python I add the module to the bin folder of my app so that it's part of the app. Installing/placing the module in Splunk's Python means that when you upgrade Splunk the module could get removed. ... View more

Splunk by itself is great for getting data into one place for viewing. Splunk will try its best to extract fields it sees but doesn't always get everything. Also, dashboards that provide value related to a particular data source (e.g. web proxy logs) don't exist by default in Splunk. Applications provide the following functionality: Knowledge objects to parse the data (field extractions, eventtypes that classify data into types (e.g. authentication events)) Dashboards to view the data in a meaningful way Some applications provide modular inputs to pull data from a particular source into Splunk To do this yourself you will find the task to be daunting. Applications make that easier. If you download and install an app in your Splunk environment you may find that there is some tweaking that will need to be done (e.g. specifying what index your data resides). Splunk applications allow the end user to customize an app to fit in their environment. Apps aren't compiled. You have access to all of the Python scripts (if there are any) and configuration files. Bottom line applications (if written correctly) can make your life simpler. ... View more

At first glance it seems like you're wanting to filter your results using lookupfile. By default the lookup command adds additional fields to your results. In order to filter you're probably going to want to use inputlookup in a subsearch. Basic example: index=abc sourcetype=abcdef [search | inputlookup lookupfile | fields user]... ... View more

I would set up an app on your deployment server that pushes the inputs.conf out for each server. You can change the index in that file. Then when you configure the UF you can set the deployment server to access and it will pull the new configuration down. This method ensures that all forwarders (that match the criteria for the serverclass) get the same configuration. ... View more

When possible it's also a good idea to test upgrades in a test environment to make sure things like this don't happen. ... View more

Hi Romantic_warrior1, It looks like you're working with this donut https://splunkbase.splunk.com/app/3238 instead of our app https://splunkbase.splunk.com/app/3150 . To verify this run this search "index=_internal | stats count by sourcetype", in the results click on the visualization tab and select the donut chart. If you're using our version you will see a "Format" menu. Under the format menu there should be an option to select a "3D" donut as well as a "2D" donut. If this is missing you are not using our app. I did verify that the drilldown functionality works in our version (https://splunkbase.splunk.com/app/3150 ). Thanks. ... View more

CSV files may need to be UTF-16LE. ... View more

If you're using deployment server you can set up an app that contains the inputs.conf that you want on your Windows servers and then just push it to all of the servers. That will keep you from needing to touch every server. ... View more

Testing the config above does not work. I also looked at this doc and didn't see anything that said you could use a wildcard. It looks like you have to specify each log individually. http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/Inputsconf ... View more

I'm in the process of testing this myself. I'll let you know what I find out. ... View more

After further testing putting the apps in $SPLUNK_HOME/etc/apps allowed me to also put them in $SPLUNK_HOME/etc/master-apps and deploy to my indexers from my cluster master. So it appears that validation is happening when the apps reside in $SPLUNK_HOME/etc/apps but Splunk doesn't look for spec files in $SPLUNK_HOME/etc/master-apps when the app has been place here. Thanks dwaddle!!! ... View more

Thanks dwaddle. I did have the spec file in the $SPLUNK_HOME/etc/master-apps/Splunk_TA_vmware/README and the references were in the inputs.conf.spec file. It appears that there is an issue when the app doesn't reside in the $SPLUNK_HOME/etc/apps folder. I installed the app on the indexers manually instead of via the cluster master and everything works fine. ... View more

Alteek did you get this resolved? I'm running into the same issue. ... View more

I ran this on our problem servers and was able to install the forwarders as well. Thanks. ... View more

We did a little more testing and figured out that the forwarder thinks the release is incompatible because the server is an Intel server and the install thinks it's an AMD64. ... View more