Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: IP Reputation App: Why do I keep getting "Sear...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IP Reputation App: Why do I keep getting "Search is waiting for input"?
I have my router sending syslog data to splunk server. Search and Reporting is populating syslog data in real-time with no issue. Now I have installed IP-Reputation app and I keep getting Search is waiting for input. Are there any configurations needed to populate data through the IP Reputation app?.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, I get nothing as well. I followed the procedures outlined.
Do I need to tweak it for my indexes?
Or, do I need to modify "tag=network tag=communicate action=allowed"?
Does Python need to be installed separately? If so, which version?
How do we go about troubleshooting?
I've got other apps installed and working. I'm pulling in syslog data from iptables firewall with logging on all the acls.
I'm also pulling in data from Meraki APs and a Synology NAS,
Thanks,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
<form>
<label>Threat Map Overview</label>
<row>
<html>
<h3>How it works</h3>
<p>This page visualizes the geo information of blacklisted IP's which have been found in your machine data. Filter down if requiered. </p>
<p>Search Command executed: </p>
<p><pre> <b>$filter$</b> | iplocation <b>$lookupfield$</b> | lookup threatscore clientip as <b>$lookupfield$</b>| where threatscore>0 | geostats count by threatscore</pre></p>
</html>
</row>
<fieldset autoRun="false" submitButton="true">
<input type="time" searchWhenChanged="true">
<default>Last 24 hours</default>
</input>
<input type="text" token="filter">
<label>Filter-Search</label>
<default>eventtype=ip_check</default>
</input>
<input type="text" token="lookupfield">
<label>IP-Address Field to lookup:</label>
<default>dst_ip</default>
</input>
</fieldset>
<row>
<map>
<title>Threat Map</title>
<searchString>$filter$ | iplocation $lookupfield$ | lookup threatscore clientip as $lookupfield$ | where threatscore>0 | geostats count by threatscore</searchString>
<option name="height">400px</option>
<!-- use custom colors -->
<option name="mapping.seriesColors">[0x5379af,0x9ac23c,0xf7902b,0x956d95,0x6ab7c7,0xd85d3c,0xfac51c,0xdd86af]</option>
<!-- adjust marker opacity and size range -->
<option name="mapping.markerLayer.markerOpacity">0.8</option>
<option name="mapping.markerLayer.markerMinSize">10</option>
<option name="mapping.markerLayer.markerMaxSize">60</option>
<!-- set initial map center and zoom level -->
<option name="mapping.map.center">(30.810646,-10.556976)</option>
<option name="mapping.map.zoom">2</option>
</map>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am still getting the same message "Search is waiting for input".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check the XML for the dashboard you are looking at, and ensure that
the latestTime tags
are populated with something such as
<latestTime>now</latestTime>
Fun with Regular Expression - multiples of nine
[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...
What’s New & Next in Splunk SOAR
