Hi everyone, I was attempting to utilize this dashboard, but am having difficulty populating the user accounts. https://gosplunk.com/windows-dashboard-showing-who-was-logged-on-to/ This is what the dashboard currently looks like, as you can see, the user account section is not populated. My goal is to have either the TargetUserName or TargetUserSID populated in the account section with a regex that will catch all user accounts. Any help will be greatly appreciated. This is the search being performed index="wineventlog" source="XmlWinEventLog:Security" EventCode=4624 (Logon_Type=10 OR Logon_Type=7 OR Logon_Type=2) host=$HostName$ | rex "New Logon:\s+Security ID:\s+(?<account>.*)" | eval Type=case(Logon_Type=10,"Remote Logon", Logon_Type=2,"Local Logon", Logon_Type=7,"Screen Unlock") | table _time host Type account | sort _time desc Here is an example of the Windows XML event <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4624</EventID><Version>1</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-05-21T14:23:42.544642200Z'/><EventRecordID>20131980</EventRecordID><Correlation/><Execution ProcessID='560' ThreadID='872'/><Channel>Security</Channel><Computer>Computer.AD.computer.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>Computer$</Data><Data Name='SubjectDomainName'>AD</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='TargetUserSid'>AD\admin-v</Data><Data Name='TargetUserName'>admin-v</Data><Data Name='TargetDomainName'>AD</Data><Data Name='TargetLogonId'>0x1f02e303</Data><Data Name='LogonType'>10</Data><Data Name='LogonProcessName'>User32 </Data><Data Name='AuthenticationPackageName'>Negotiate</Data><Data Name='WorkstationName'>Computer</Data><Data Name='LogonGuid'>{00000000-0000-0000-0000-000000000000}</Data><Data Name='TransmittedServices'>-</Data><Data Name='LmPackageName'>-</Data><Data Name='KeyLength'>0</Data><Data Name='ProcessId'>0x20b8</Data><Data Name='ProcessName'>C:\Windows\System32\winlogon.exe</Data><Data Name='IpAddress'>10.0.0.0</Data><Data Name='IpPort'>0</Data><Data Name='ImpersonationLevel'>%%1833</Data></EventData></Event> ... View more

Hi everyone, Can someone please help with a search I'm trying to create. My end goal is to capture which user account logged into the server and have a time associated with their login. My search so far is below. This only gives me the count of how many times the users logged in for the past "x" days. index="wineventlog" host="Redacted" source="XmlWinEventLog:Security" | stats count by SubjectUserSid ... View more

Hi everyone, We are looking into the possibility of another way to monitor the Splunk universal forwarders on our servers, besides within the search head or deployment server. One idea raised was utilizing Solar winds to monitor the UF process. I believe the only process that would need to be monitored for Linux would be the Splunk daemon or are there other dependencies that should be monitored as well? Thank you for your time! ... View more

Hi all, I was working with Splunk's support on an issue with my previous post. They suggested the first step should be to correct the error seen in splunkd.log with interfaces.sh seeing a virbr0 interface on my CentOS machines. I temporarily disabled interfaces.sh as a stop-gap to see if it fixes the issue, but I would like to correct it permanently. The hosts are VMs, and to my understanding virbr0 is there should the host act as a hypervisor. Because we are not creating any VMs from these hosts, this interface should be redundant. Is there a way to NOT have interfaces.sh monitor the virbr0 interface? Below are the errors I am receiving. Thank you. 04-21-2020 08:38:52.939 -0400 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/interfaces.sh" cat: /sys/class/net/virbr0/duplex: Invalid argument 04-21-2020 08:38:52.951 -0400 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/interfaces.sh" cat: /sys/class/net/virbr0/speed: Invalid argument 04-21-2020 08:38:52.955 -0400 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/interfaces.sh" cat: /sys/class/net/virbr0-nic/duplex: Invalid argument 04-21-2020 08:38:52.964 -0400 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_nix/bin/interfaces.sh" cat: /sys/class/net/virbr0-nic/speed: Invalid argument ... View more

Hi everyone, I could really use some input from you all. I am using Splunk cloud in my environment, with a deployment server on-prem for universal forwarders. Two days ago, I stopped receiving data in six indexes. The data retrieved from the indexes originates from a Syslog server. Steps I have taken so far: Verify logs are currently being created in Syslog from the sources Verify Syslog server can still reach deployment server via ping Verify Splunkd is running on the Syslog server Verify deployment server has received a recent phone home from the Syslog server Verify data from other universal forwarders is searchable on the Search head ... View more

Hi everyone, I'm a total Splunk noob. The title basically says it all. I recently changed the group from enterprise to forwarder. Now I cannot access the GUI. Is there a way I can change it back from the CLI? Also, will this change affect the current operations of the heavy forwarder? Thank you. ... View more