getwatchlist

[WLOCK8]

Question I work where we need to query mulitiple domains/IPs weekly to ensure none of our host
have communicated with these Domains/IPs. Is the getwatchlist App the correct path to choose to meet this objective?

[WLOCK8]

Dave

Get this error " The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."

We were able to use the getwatchlist and the domains we want to query shows up, but how do we get that list of domains to be query agains our feeds that are feed into splunk ?

Will

[dshpritz · Accepted solution]

Well, I am a little biased, but I would think so. Getwatchlist would be a good candidate if:

1. The list is available via HTTP, HTTPS or FTP
2. The list is in a delimited format (for example, one IP per line, CSV, tab delimited, etc.)

HTH,

Dave

[dshpritz]

Will,
It sounds like there is something else going on with your Splunk instance. You should check your logs or look at the SoS app to diagnose.

Here are some good blog posts on using getwatchlist against your data:

http://blogs.splunk.com/2011/08/16/getwatchlist-getting-watchlists-into-splunk-quickly-and-easily-wi...

and

http://blogs.splunk.com/2011/09/08/anonymous-proxies/

Both of the posts contain examples of how you can use your downloaded watchlist against your events.

Thanks,

Dave

[WLOCK8]

Dave

Get this error " The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."

We were able to use the getwatchlist and the domains we want to query shows up, but how do we get that list of domains to be query agains our feeds that are feed into splunk ?

Will