A better way to do this is to use the "Run a Script" alert action (after you create a script to do the copy).  Yes, this alert action is deprecated but I use it often and there is no way that Splunk will be removing it from the product.

The base instructions here should be all you need to follow for that one. Review the rest of the 'planning' and 'securing' sections of that documentation to see any additional details you might be curious about, though.

The current query can't do that because it only looks at failed logins.  It will never see a successful login. The solution will entail appending a tstats command that counts successes and then modifying the where command to look for 6 or more failures and at least 1 success. You can find an example in the Basic Brute Force Detection use case in the Splunk Security Essentials apps.

Going the route I am inquiring about is not my preference. I have kind of a convoluted internal network. I have requests in with my network team to get ssl passed through to where I need it and in the meantime am just trying to consider other options in case they can't make it work. 

I'm a little suspicious of the formatting after the line: community: "public" Could you try adjusting so it's like this? community: "public" fields: - name: "some_name" oid: "x.x.x.x.x.x.x.x.x.x.x.x.x" If that doesn't help, if you could email me the agent_config.yaml, I'll take a closer look (the pdf kills the indentation). Just add "@splunk.com" to my username if you want to send it. Thanks!

Hi. Have a look at  https://community.splunk.com/t5/Splunk-Search/Why-is-Lookup-definition-in-transforms-conf-not-returning/td-p/589334 Sounds like there's a lookup definition in a transforms.conf and the corresponding lookup file does not exist. You can use btool on the Splunk head to locate the setting. For example /opt/splunk/bin/splunk btool transforms list --debug | grep file   You can see all the lookup file definitions.

Thank you, config is attached ... I've obscured the ip...    Here's the log    Apr 11 16:44:00  otelcol[142312]: 2024/04/11 16:44:00 main.go:89: application run finished with error: failed to resolve config: cannot resolve the configuration: cannot retrieve the configuration: configsource provider failed retrieving: yaml: line 91 : did not find expected key Apr 11 16:44:00 systemd[1]: splunk-otel-collector.service: Main process exited, code=exited, status=1/FAILURE Apr 11 16:44:00 systemd[1]: splunk-otel-collector.service: Failed with result 'exit-code'. Apr 11 16:44:01 systemd[1]: splunk-otel-collector.service: Scheduled restart job, restart counter is at 5. Apr 11 16:44:01 systemd[1]: Stopped Splunk OpenTelemetry Collector. Apr 11 16:44:01 systemd[1]: splunk-otel-collector.service: Start request repeated too quickly. Apr 11 16:44:01  systemd[1]: splunk-otel-collector.service: Failed with result 'exit-code'. Apr 11 16:44:01 systemd[1]: Failed to start Splunk OpenTelemetry Collector.