Hi My ES threat list download is thru proxy server. Other threat list are being download normally. Only the palevo_ip_blocklist failed a while ago. Error message: INFO msg="A threat intelligence download has failed" stanza="palevo_ip_blocklist" status="threat list download failed after multiple retries" uri="https://palevotracker.abuse.ch/blocklists.php?download=ipblocklist" I try the url in my own laptop, and I got a 403 permission denied message on the webpage. Any idea why threatlist download failed for 1 source only? Cheers, ... View more

Hi team, We are in Enterprise Security I cleared one of the default Glass Table by mistake. Is there a way to restore this glass table. I understand this "ES Deployment Template" is an out-of-the-box glass table. Could I restore the glass table by copyoing the configuration files from other Enterprise Security instance? If yes, and what files/folder should I copy from? Thanks. Season ... View more

Hi guys, I got these error on pretty much all of my splunk universal forwarder. 03-06-2017 12:25:27.743 +1300 ERROR AuditTrailManager - Private key error Error opening /opt/splunkforwarder/etc/auth/audit/private.pem: No such file or directory 03-06-2017 12:25:07.360 +1300 WARN AuditTrailManager - Private key file does not exist but is defined in audit.conf - no local event signing will take place. You can create auditTrail keys if necessary by running splunk createssl audit-keys I also found this had been marked as a known bug: SPL-119172, SPL-122917, SPL-122918 http://docs.splunk.com/Documentation/Splunk/6.4.6/ReleaseNotes/6.4.2 So my question is, is there any impact on this known bug? And what is the work around? ... View more

Hi everyone, Currently I am trying to train splunk to monitor some logs in a directory. 1.The permission on the directory is drwxr-xr-x, 2. and the logs inside the directory is -rw------- 3. So I do chmod +r // -R. After the change, file permission become -rw-r--r--, and splunk can read these log files without problem. 4. However, each time the application generates new logs file, new log files will be written as -rw------- again. So how can we get splunk to monitor these log files? Or do we have to add the read permission on the entire directory permanently? So that all new log files generated will automatically inherit the "-rw-r--r--" permission. Thanks. ... View more

We just found SSLv3 "POODLE" vulnerability alerts from our IPS system. And our Splunk Universal Forwarder is in 6.4.2. I thought the SSLv3 POODLE issue only appear at Splunk version earlier than 6.3? Should I use the same workaround mention here? https://answers.splunk.com/answers/176970/is-it-possible-to-disable-ssl-v3-on-the-universal.html Many thanks in advance. ... View more

Hi guys, Anyone ever seen this: When I load the Splunk page, the navigation bar at the top looks OK. Then I load the Splunk Enterprise Security (ES) app, the navigation layout just changed to something strange and cannot restore automatically. Also the drop-down list is not showing anything. Cleaned cache and cookies, NO joy. Switch to a different browser, still the same issue. Browser I am using: IE11(Version 11.0.9600.18524) Firefox: 19.0.5 (Tried 50.1.0 as well) Any idea will be much appreciated. Thanks. ... View more

Hi any one have experience of this app. Our Splunk server doesn't have access to Internet. Could we use the image in our local directory? I tried something like this: (my search table)|eval img="/opt/splunk/etc/apps/test/bin/Floppy-Disk-128.png" | eval state = case(warning_level == "OKAY","DarkOliveGreen", warning_level == "WARNING","FireBrick") | table host img state It could not display my image. Any thoughts? Thanks a lot. Cheers, Vincent ... View more