Hi Splunk, I am trying to create splunk search in my python script where the script is being used to create HPSM ticket. I have created HPSM action and added to correlation search adaptive response action and this executes python script and I need to find event_id for orig_sid (sid from splunk statndard input) before creating ticket and need to add event_id in request to create HPSM ticket. using this I have created method in the same script to run search to get event id for the same sid. search is returning void. if I run method in different python script its working fine. Here is my method which will create search in splunk(used both create and export) def run_search(sid):         logger.debug("Entered with sid '%s'",sid)         #sid='scheduler_s785863SplunkEnterpriseSecuritySuite_RMD53eff93817270d051_at_1511794860_96'         sid=sid         #kwargs_export = {"earliest_time": "-24h","latest_time": "now","search_mode": "normal","output_mode":"json"}         searchquery_export = "search `notable`| search orig_sid=" + sid + " | table event_id"         logger.debug("Search Query '%s'",searchquery_export)         service = client.connect(username="splunk", password="********")         logger.debug("Service connect %s",service)         #time.sleep(60)         #exportsearch_results = service.jobs.export(searchquery_export, **kwargs_export)         job = service.jobs.create(searchquery_export,{"exec_mode": "blocking"})         logger.debug("Inner job SID '%s'", job)         result_stream = job.results()         reader = results.ResultsReader(result_stream)         for item in reader:                 logger.debug("Inner job Results '%s'", item)         #query_results = exportsearch_results.read()         #logger.debug("Notable Result '%s'", query_results )         #return query_results If I use static sid , its working . Please help me out. Thanks in advance. ... View more

Hi, I have McAfee logs coming in to Splunk using Splunk DB Connect application. There are total 3 fields related to user name: 1. user 2. source_logon_user 3. logon_user and the mcafee logs tagged to malware, attack, operations and the data is being accelerated by Malware datamodel. Malware data model looks for user and user field is available in McAfee logs, but the problem is I need to consider logon_user/source_logon_user not user field, I could simply rename source_logon_user/logon_user to user to work with CIM, again the problem with logon_user/source_logon_user has username like : domain\username [email protected] username how to deal with the above scenarios, the reason why I would like to reformat the username field from above three scenarios to user, when we search something user=username , it will not return user=domain\username. please help me out, if any spelunker already faced/solved this problem. ... View more