Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About MBIT2022
MBIT2022
Explorer
Member since:
02-02-2022
02-10-2022
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 02-02-2022 |
Activity Feed
- Posted Re: No search results from Windows Servers (DC and EXCH) on Splunk Search. 02-10-2022 09:13 AM
- Karma Re: No search results from Windows Servers (DC and EXCH) for PickleRick. 02-10-2022 07:56 AM
- Posted Re: No search results from Windows Servers (DC and EXCH) on Splunk Search. 02-10-2022 07:55 AM
- Posted Re: No search results from Windows Servers (DC and EXCH) on Splunk Search. 02-10-2022 05:45 AM
- Posted Re: No search results from Windows Servers (DC and EXCH) on Splunk Search. 02-08-2022 04:03 AM
- Posted Re: No search results from Windows Servers (DC and EXCH) on Splunk Search. 02-08-2022 03:48 AM
- Posted Re: No search results from Windows Servers (DC and EXCH) on Splunk Search. 02-08-2022 03:32 AM
- Karma Re: No search results from Windows Servers (DC and EXCH) for richgalloway. 02-08-2022 03:29 AM
- Posted Re: No search results from Windows Servers (DC and EXCH) on Splunk Search. 02-08-2022 03:28 AM
- Posted Re: No search results from Windows Servers (DC and EXCH) on Splunk Search. 02-07-2022 07:15 AM
- Posted Re: No event results from Windows Servers (DC and EXCH) on Splunk Search. 02-04-2022 06:41 AM
- Posted Re: No event results from Windows Servers (DC and EXCH) on Splunk Search. 02-04-2022 05:26 AM
- Posted Re: No event results from Windows Servers (DC and EXCH) on Splunk Search. 02-04-2022 04:04 AM
- Posted Re: No event results from Windows Servers (DC and EXCH) on Splunk Search. 02-02-2022 09:14 AM
- Posted No search results from Windows Servers (DC and EXCH)- what to do next? on Splunk Search. 02-02-2022 06:57 AM
- Tagged No search results from Windows Servers (DC and EXCH)- what to do next? on Splunk Search. 02-02-2022 06:57 AM
- Tagged No search results from Windows Servers (DC and EXCH)- what to do next? on Splunk Search. 02-02-2022 06:57 AM
- Tagged No search results from Windows Servers (DC and EXCH)- what to do next? on Splunk Search. 02-02-2022 06:57 AM
- Tagged No search results from Windows Servers (DC and EXCH)- what to do next? on Splunk Search. 02-02-2022 06:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
02-10-2022
09:13 AM
So this is strange... I went to the Splunk for Windows app and it brought me to the Overview page but it's a dashboard for AWS.. To my knowledge no one has changed any config files so I don't understand why its showing this. The server path is correct: splunk8/en-US/app/Splunk_TA_windows/overview
... View more
02-10-2022
07:55 AM
This is the same as Windows TA correct? We have it installed but I don't feel it was configured correctly as it gives no results on the App screen..
... View more
02-10-2022
05:45 AM
@PickleRick I was able to manually install the forwarder on 9 workstations. I am definitely receiving more data but I'm still not seeing the events I need (successful/failed logins, print activity, file/folder modifications). Is there anything that needs to be configured via GPO? I have all servers set to collect and forward event logs. I want to share my .conf files but the network with Splunk is isolated and classified, so it is very difficult to move over data. Thanks
... View more
02-08-2022
04:03 AM
Ok, I'll look more into it. Thanks
... View more
02-08-2022
03:48 AM
Ok, I'll try to install forwarders on some workstations today and see if anything changes. For reference, when installing the forwarder should I be choosing Local or Domain under Configuration Options? I updated the forwarder on the DCs last week and couldn't find any set answer on which to choose. Thanks
... View more
02-08-2022
03:32 AM
Unfortunately we currently do not have any software deployment tools. My server admin also informed me that GPOs are not working properly so we cannot deploy via GPO. Thank you for the links
... View more
02-08-2022
03:28 AM
We were trying not to manually install the forwarders so they are installed on just the DCs and Exchange servers (and other servers). We are able to pull information with a generic search but cannot see workstation or user specific information. I feel that either a setting is incorrect on the server or there is something misconfigured in one of the .conf files. @PickleRick
... View more
02-07-2022
07:15 AM
It appears that we need to install the universal forwarder on every workstation. Is there any easy way to deploy it remotely? We do not have SCCM nor a Altiris license. Thanks
... View more
02-04-2022
05:26 AM
I ran a "index=*" search for the last week to date and so far it's only returned 46 hosts and 90mil events. Many are duplicate events but it appears that not all the servers and workstations are reporting and/or the forwarder is nor installed or configured properly. I will look into this further. We are also using 2.8.1. Is it absolutely necessary to update to 2.8.4? I ask only because every forwarder will have to be manually updated for the workstations. Thanks
... View more
02-04-2022
04:04 AM
I'm honestly struggling to understand SPL. But if I try wildcard entries such as *login or *error I receive some results but only from a handful of servers and it's not always what I'm looking for. For other searches, it shows "0 of 2,500,000 events matched" so I know that Splunk is receiving data but for some reason its not letting me search for it. If that makes sense
... View more
02-02-2022
09:14 AM
What I mean is that when I attempt to search for events in the Splunk GUI, it's not returning any results. The only search that really gives me results is an error search, but all the errors trace back to only 3-4 of my servers. At least one is a Linux server and the others are Windows.
... View more
02-02-2022
06:57 AM
I recently inherited a newly configured Splunk Enterprise 8 environment after the former admin left. I have a basic user level knowledge of Splunk so I will describe my issue the best I can.
When we try to search for a specific or wildcard event (ie: print logs) we only receive results from the Linux servers but not the Windows servers. I was suggested to check the .conf files for Windows TA, but I'm not quite sure what I should be looking for within the files. The Splunk documentation site has been helpful, however it doesn't explain why we aren't seeing events. Splunk is installed on RHEL8 and we have installed forwarders on all the servers. I do not know where to go from here. Any assistance is appreciated.
*Note: Former admin claimed that the server was fully configured in accordance with DIA's required auditable event list. The server is receiving data however it is not being disseminated properly.
... View more
Labels
- Labels:
-
troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-10-2022
12:34 PM
|
