Hi, I came across a guide on the official Tufin website detailing the integration between Tufin and SOAR Phantom: https://extensions.tufin.com/details/tufin-splunk-phantom-integration This integration offers a range of actions, including the capability to block domains. However, when I checked the Splunk App Store, the available Tufin app seems to have a limited set of actions and does not include the ability to block IPs or domains: https://splunkbase.splunk.com/app/5859 Is anyone having this app and would be willing to share it? Or if you have developed something similar in the past, could you share some tips?   Thanks

Hi All, My file is not reindexing though I used below settings in my inputs configuration file  . File is very small (300 char) and wont change often,  want file to reindex daily .  Kindly help . crcSalt = <SOURCE>  initCrcLength = 256

I developed my first app and am trying to integrate it into CIM using the documentations. so far I Successfuly defined an eventtype in eventtype.conf [my_event_type] search = sourcetype=my_source and when I search for this event type I get all the results: eventtype=my_event_type Now I continue to define tags, using this guide My tags.conf file looks like this: [eventtype=my_event_type] alert = enabled But nothing is returned when I search for: tag=alert Moreover when I search for all types of tags I get only one type "error" and it's count is significantly less then the eventtype amount: sourcetype=my_source | stats count by tag In the guide it says "Once you have tagged an event type, you can search for it in the search bar" but I can't search for the tags. How can I troubleshoot the process? What should I look for? What am I missing? thank you.

Hello Team,   I have 2 look up data and I want to join them through a common field MonthYear. I need to calculate transmission per dept = Total transmission *(size of dept/total size of dept) In lookup1 I need to calculate the propotion of size based on dept eg; Transmission for Eng dept = 119 *((100+23)/ 170) Lookup1: MonthYear  size  org  dept July 2022 100 research Eng July 2022 23 research Eng July 2022 2 data IU July 2022 45 research Lab Total size 170   Lookup2: MonthYear Transmission ID July 2022 60 global July 2022 34 global July 2022 23 Pbg July 2022 2 pcf Total transmission 119   I made a merge of 2 lookup with join using MonthYear but I am able to pass only one token value at a time. I need to get pie chart based on calculated formula for org and sort for top values in dept Code: |inputlookup lookup2.csv |search MonthYear="July 2022" |join MonthYear   [|inputlookup lookup1.csv]  |stats sum(Transmission) as TotalTransmission, sum(size) as Totalsize by MonthYear  |join MonthYear  [|inputlookup lookup1.csv   |search dept="Eng"   |stats values(MonthYear) as MonthYear,sum(size) as DeptMem by dept] |eval "Transmission per dept" = round(("Transmission per dept") * (DeptMem/Totalsize),2) |fields "Transmission per dept"

I have Splunk SH Cluster ( 3 SH's in Cluster)  and we are collecting Checkpoint logs using Syslog and then Splunk HF read the Checkpoint logs (basically a flat file) and indexes into Splunk.  Now my issue is I see the events are extracted as it should when we use an add-on.  However I do not see any Checkpoint app/add-on this is installed on SH's / HF.  No manual field extractions either.  I would like to know if there is any away to check how the fields are extracted ? Secondly, We also have a separate SH running ES.  On this, I don't see the events being extracted as I see it on our SH cluster.  I did try to install Splunk Add-on for Checkpoint to parse the fields and make it CIM compliant but the fields are not extracted.  I changed the sourcetype of the CP logs to match it with the add-on but still no luck.  I am using Splunk Add-on for Check Point Log Exporter.  Appreciate your thoughts on this.