2020-01-23 01:57:07,390 ERROR A general exception was thrown when executing the import Traceback (most recent call last): File "D:\Program Files\Splunk\etc\apps\google_drive\bin\google_spreadsheet.py", line 211, in import_file last_updated = google_lookup_sync.import_to_lookup_file(lookup_name, None, None, spreadsheet_title, worksheet_name, session_key, create_if_non_existent=False) File "D:\Program Files\Splunk\etc\apps\google_drive\bin\google_drive_app\__init__.py", line 293, in import_to_lookup_file splunk_lookup_table = lookupfiles.SplunkLookupTableFile.get(lookupfiles.SplunkLookupTableFile.build_id(lookup_name, namespace, owner), sessionKey=session_key) File "D:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\models\base.py", line 572, in get return SplunkRESTManager(cls, sessionKey=sessionKey).get(id) File "D:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\models\base.py", line 552, in get entity = self._get_entity(id, host_path=host_path) File "D:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\models\base.py", line 468, in _get_entity return self._fix_entity(splunk.entity.getEntity(self.model.resource, None, sessionKey=self.sessionKey, uri=id)) File "D:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\entity.py", line 276, in getEntity serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "D:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\rest\__init__.py", line 553, in simpleRequest raise splunk.AuthenticationFailed AuthenticationFailed: [HTTP 401] Client is not authenticated Please advise. ... View more

I have set-up the API and it has been working beautifully for weeks. Currently, we have an import setup for an interval of 15m. However, we havent' received any new data for the last 4-5 days. Indeed, the target lookup csv has not been updated since. The API key checks-out. Is there any place we can see the status of the app's jobs? ... View more

I am using this as a reference: https://answers.splunk.com/answers/470198/how-to-create-a-multistage-sankey-diagram-with-a-s.html I am trying to build a sankey diagram to map requests from source to a status (in this case action = success or failure): index=win* | stats count by src dest action | appendpipe [stats count by src dest | rename src as source, dest AS target] | appendpipe [stats count by dest action | rename dest as source, action AS target] But the problem is that it gives me a count of the actions (which there are only 2 possible actions), and not an actual count So the original search: index=win* | stats count by src dest action gives me a table like: src | dest | action | count ip1 srv1 failure 218 ip1 srv1 success 300 ip1 srv2 failure 1579 ip1 srv2 success 216 ip2 srv1 failure 1418 ip2 srv1 success 141 ip2 srv2 failure 97 ip2 srv2 success 1031 (there would be 8 combinations) But the appendpipe to create the sankey: | appendpipe [stats count by src dest | rename src as source, dest AS target] | appendpipe [stats count by dest action | rename dest as source, action AS target] | search source=* | fields source target count gives me a table like: source | target | count ip1 srv1 2 ip1 srv2 2 ip2 srv1 2 ip2 srv2 1 srv1 action1 2 srv1 action2 2 srv2 action1 2 srv2 action 2 2 ... View more

Greetings... We are currently using ES and ingesting data from our IDS and AV to populate the Malware DataModel. According to the documentation: https://docs.splunk.com/Documentation/CIM/4.13.0/User/Malware Dataset name: Malware_Attacks Field name: action Data type: string Description: The action taken by the reporting device. Abbreviated list of example values: ES expects: allowed Other: blocked, deferred In our DataModel, we have an Eval Expression that uses a CSV inputlookup: | inputlookup actions_te.csv Which is not always helpful as there are a LOT of events being picked up by "deferred" Would it still be CIM compliant if we evaled Redirect and Detect events as their own actions? Would this break anything in ES? Thanks in advance. ... View more

Greetings-- I have an asset lookup gen that begins with: | stats latest(src_ip) as ip latest(os) as os **latest(primary_user) as owner latest(user_name) as user** latest(src_mac) as mac by client_name | rex field=client_name "^[^\.]+\.(?P<dest_domain>.+)" | rex field=client_name "^(?<nt_host>[^\.]+)" However, out asset lookup fields do not contain "user": https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Formatassetoridentitylist ip,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av When I try: |makeresults | eval src="1.2.3.4" | get_asset(src) It automatically puts primary_user as the owner. However, I would ideally like it to: Assign latest(user_name) as owner and if latest(user_name)=null, then assign latest(primary_user) as owner, and if both are $null, then to make owner default to "unknown" I'm not sure how to include the eval latest() inside of |eval owner= case(...), etc. Any advice would be greatly appreciated. ... View more