Monitoring Network Traffic with Sysmon and Splunk
Every IT guy has a set of tools that they use every day. One of mine is sysinternals. It’s a set of Windows utilities made available by Microsoft that do a whole slew of things. You can install them...
View ArticleSplunk App for SharePoint goes Open Source
For about the last year, I’ve been working on an update to the Splunk App for SharePoint. But it isn’t the one you would expect. I’ve been working to open source the app. At the end of the day the best...
View ArticleSplunk 6.2 Feature Overview: Perfmon Delocalization
Last week, I covered the XML Event Logs – an awesome feature that will reduce your data ingest, increase the fidelity of the data that is stored and allow us to work with localized data. Today, I want...
View ArticleSplunk 6.2 Feature Overview: XML Event Logs
We’ve been (rightly) criticized for a couple of things in recent years. Firstly, when you configure a Windows Event Log, it’s too big. This is because we combine the event log object with the message...
View ArticleIntegrating Active Directory into Splunk with SA-ldapsearch
On Tuesday, I introduced one of the first presentations at .conf2014 – a major update to the SA-ldapsearch app. This new app has now launched and you can download it at...
View ArticleClik here to view.
What’s new in TA-windows 4.7.0?
If you are a Windows admin and use Splunk then you’ve likely deployed Splunk_TA_windows on your endpoints. It’s a central method for handling Windows data and has all the extractions you need to handle...
View ArticleMonitoring Local Administrators on Windows Hosts
It is always gratifying when one of my readers comes to me with a problem. I love challenges. This one had to do with one of my old posts surrounding Local Administrators remotely. Of course, the way...
View ArticleInstall Splunk with PowerShell (2014 Edition)
One of our avid twitter followers asked how to reliably install the Splunk Universal Forwarder on a Windows host with PowerShell last week. I’ve posted about all the intricacies involved before but...
View ArticleControlling 4662 Messages in the Windows Security Event Log
You’ve just installed the Splunk App for Windows Infrastructure, or its friend the Splunk App for Exchange. You’ve followed all the instructions, placed the Universal Forwarders on the domain...
View ArticleFixing Scripted Inputs in Tiered Deployments
The Splunk App for Microsoft Exchange has a useful lookup named ad_username. It takes the various forms that you can logon to a domain as (like DOMAIN\user and user@domain.com) and normalizes them....
View ArticleUpgrading Windows Inputs from Splunk 5.x to Splunk 6.x
If you are a long time Splunker, you might have your environment on an older Splunk version and haven’t taken the plunge to Splunk 6 yet. One of the common questions we get during upgrades is “how do I...
View ArticleWindows Print Monitoring in Splunk 6
Splunk 6 has been out almost six months and I have not yet finished covering all the new Windows features. Let’s continue doing that by looking at print monitoring. If you have ever wanted to do charge...
View ArticleDetecting Windows XP Systems with Splunk
Windows XP is dead! Soon after Windows XP was introduced, Microsoft introduced the Trustworthy Computing Initiative – a kind of “security first” thinking that has been the hallmark of Microsoft for the...
View ArticleRunning two Universal Forwarders on Windows
We get quite a few requests on how to run two Splunk Universal Forwarders on the same Windows host. Why would you do this? The primary reason is that you have a lab environment and want to compare one...
View ArticleWhat’s new in Microsoft Apps
Splunk is exhibiting at the Microsoft Exchange Conference this week. If you are in town, please stop by booth #805 in the Eastside to see us. To coincide with this conference, we are releasing a whole...
View ArticleSplunk on Windows, Clustering and IPv6
We had fun this week in our Seattle office setting up clustering for Splunk on Windows on a pure-IPv6 network. IPv6 has been gaining acceptance more outside the US than within for quite a number of...
View ArticleCorrelating Cisco ESA with Microsoft Exchange for Message Tracking
One of the great features of the Splunk App for Microsoft Exchange is that you can track messages to the edge. It doesn’t matter what type of devices we go through, we get to see the messages and what...
View ArticleCorrelating Windows and VMware Host Information
When you install a new virtual host on VMware, you get to give it any name you want. The name has nothing to do with what is running on the host. How can we go from the Windows information to the...
View ArticleClik here to view.
Introducing the Cisco Security Suite for Splunk 6
I know. I normally blog about Microsoft stuff. Recently, however, I’ve been helping out on another project – updating the Cisco Security Suite to be compatible with Splunk 6. The Cisco Security...
View ArticleUniversal Forwarders and the Splunk App for Active Directory
About once a week I respond to a call or online question asking about the Splunk App for Active Directory. Specifically, these questions ask one of two things. The first is “can I collect the Active...
View Article
![[imports/adg/photos/213899875_Police-Car-Lights-2.jpg]](http://wehco.media.clients.ellingtoncms.com/imports/adg/photos/213899875_Police-Car-Lights-2_t600.jpg?4326734cdb8e39baa3579048ef63ad7b451e7676)
![Suupeas – Fall in Dream (2026-10-09) [Single, FLAC 24bit/48kHz]](http://getimg.link/images/2026/10/17/442240.md.jpg)