Getting Data In

getwatchlist

WLOCK8
New Member

Question I work where we need to query mulitiple domains/IPs weekly to ensure none of our host
have communicated with these Domains/IPs. Is the getwatchlist App the correct path to choose to meet this objective?

Tags (1)
0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

Well, I am a little biased, but I would think so. Getwatchlist would be a good candidate if:

  1. The list is available via HTTP, HTTPS or FTP
  2. The list is in a delimited format (for example, one IP per line, CSV, tab delimited, etc.)

HTH,

Dave

View solution in original post

0 Karma

WLOCK8
New Member

Dave

Get this error " The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."

We were able to use the getwatchlist and the domains we want to query shows up, but how do we get that list of domains to be query agains our feeds that are feed into splunk ?

Will

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Well, I am a little biased, but I would think so. Getwatchlist would be a good candidate if:

  1. The list is available via HTTP, HTTPS or FTP
  2. The list is in a delimited format (for example, one IP per line, CSV, tab delimited, etc.)

HTH,

Dave

View solution in original post

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Will,
It sounds like there is something else going on with your Splunk instance. You should check your logs or look at the SoS app to diagnose.

Here are some good blog posts on using getwatchlist against your data:

http://blogs.splunk.com/2011/08/16/getwatchlist-getting-watchlists-into-splunk-quickly-and-easily-wi...

and

http://blogs.splunk.com/2011/09/08/anonymous-proxies/

Both of the posts contain examples of how you can use your downloaded watchlist against your events.

Thanks,

Dave

0 Karma

WLOCK8
New Member

Dave

Get this error " The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."

We were able to use the getwatchlist and the domains we want to query shows up, but how do we get that list of domains to be query agains our feeds that are feed into splunk ?

Will

0 Karma