Hi Team, We are working on a solution to monitor the utilization time of resources on their machines. We have about 1000 machines where Splunk forwarders are installed. These forwarders are pushing data to a central splunk instance.  The issue that now we are facing is that the event codes are getting missed sometimes. For eg after an unlock(4801) there should be a lock(4800). But we are getting two simultaneous unlock event code(4801) without lock. This is sending our calculation of utilization time for a toss.   Below is the input stanza in the splunk forwarders. [WinEventLog://Security] checkpointInterval = 5 current_only = 0 disabled = 0 index = test_events start_from = oldest whitelist = 4624,4634,4800,4801   We are unable to figure out this issue for the past week. can someone pls help us out on this. Many Thanks, Naagaraj SV   ... View more

Hi All,   We are trying to monitor windows event logs from multiple systems by installing forwarders on individual machines and the logs are forwarded to a centralized splunk instance.  During network outage/disconnection of internet in the individual systems, the event codes (4800 and 4801) are not getting captured in Splunk.   Below is the input.conf  we are using [WinEventLog://Security] checkpointInterval = 5 current_only = 0 disabled = 0 index = test_events start_from = oldest whitelist = 4624,4634,4800,4801   Could you please help us out. ... View more

Hi All,   I am building a solution to monitor the windows event logs from about 800 machines using splunk deployment server setup. I am filtering for only 4 event codes using whitelist option (4624,4634,4800,4801). The logs seems to be flowing correctly and i am able to generate reports. However, the issue I am facing is that my disk space is getting filled instantly. About 50 GB for a week of data. I can increase the disk space by 200 GB, but I fear it will be filled in another 2 weeks. Can someone help out how the disk space can be optimized when monitoring the windows event logs for 800 machines.    Thanks, Naagaraj SV ... View more

Hi All, I have done a deployment server setup with over 20 machines. The deployment setup is working fine. The security team has come up with a question regarding the communication between the splunk deployment server and the forwarders. They wanted to know whether there is any API key through which authentication happens when the forwarders contacts the deployment server. Is there any other authentication mechanism which takes place in this communication. Any information would be helpful.   Thanks ... View more

Hi, I am trying to pull event logs from remote machines using universal forwarders. I have done the configuration in the inputs.conf files. below is the configuration in my inputs.conf file. [WinEventLog://Application] disabled = 0 index = win_events crcSalt = SOURCE [WinEventLog://Security] disabled = 0 index = win_events crcSalt = SOURCE [WinEventLog://System] disabled = 0 index = win_events crcSalt = SOURCE [WinEventLog://Setup] disabled = 0 index = win_events crcSalt = SOURCE Now I dont want all event codes from the logs. I would require only 4800 and 4801. is there any way in which only the events related to the two events can be forwarded to an index. Thanks ... View more

Hi, I am using a Splunk indexer as a deployment server. I have installed forwarders in about 15 machines and I am fetching the logs from these machines. However after creating the server classes and deploying apps, only machines are phoning home. The other machines are not phoning home. Can you please help on identifying the issue behind this. I have installed the splunk enterprise edition 8.x on a windows server 2016 and on trial license. Thanks ... View more

Hi All, I am using splunk enterprise version 7.1. I am looking for a way to backup the splunk index data into Amazon S3 bucket. can someone suggest a way to achieve this. I assume using hunk is deemed legacy in 7.x versions. Thanks ... View more

We have installed the splunk enterprise version 7.0.2 on a windows server 2008 R2. However we are not able to access the splunk web outside the server using the URL Http://Ipaddress:8000. ... View more