Before calling requests.post, add something like: if not url.startswith("https"): logger.critical("URL must be HTTPS") exit(1) This way when they vet your app they can see that a non-https url couldnt be used.   ... View more

Using Splunk Enterprise you wouldnt be able to do this if you're ingesting through the typical mechanisms.  The only thing that I can think of that would allow you to do this is using Splunk Data Stream Processor (DSP) - which allows you to create custom functions to apply to data streams and could be used for encryption/masking etc. https://docs.splunk.com/Documentation/DSP/1.1.0/User/PluginSDK   ... View more

Are you already running that script outside the Splunk environment? If so you might want to take a look at sending the result via HEC (https://www.splunk.com/en_us/blog/customers/http-event-collect-a-python-class.html) If not, you could use that code a base for an input by creating an Add-on with the Splunk Add-On Builder (https://splunkbase.splunk.com/app/2962/) ... View more

Are you able to check if there are any logs in the developer console/Firebug? This might suggest a particular page failing to render. ... View more

Would it be possible to create a toggle in the settings of your app for SSL, defaulting to *True* but giving you the option to set to False once uploaded? It does sound a little odd though, If it isnt using SSL when sending to localhost then I'm not sure how they can enforce it for your own app that uses the same mechanism? It might be worth asking for an escalation through support to see if you can come to an agreement with them. ... View more

You could try installing the package locally to the script to see if that makes a difference? pip install -t . pyproj ... View more

@gnangia Please could you try the latest version of the app and let me know if you still have this issue? Thanks ... View more

@shwetas Did you get to the bottom of this? Please feel free to reach out if you still have any issues. Thanks Will ... View more

Please can a moderator merge this with https://answers.splunk.com/answers/822015/splunk-enterprise-803splunk-803.html ... View more

The region us-east-1 is used because that is the only region you can get the Trusted Advisor feed from. Could you go to: YourSplunkServer/en-US/app/TA-aws-trusted-advisor/reports and Click "Open in Search" for the report "Trusted Advisor Checks Lookup Populator". This should populate the lookup file. If you then go back to the dashboard, does it load? It would be worthwhile enabling the "Trusted Advisor Checks Lookup Populator" report to run on a schedule to update with the latest Trusted Advisor checks on a regular basis. The report runs | getchecks | outputlookup trusted_advisor_checks Let me know how you get on - I'll try and get the documentation updated ASAP too. ... View more

You should be able to run something like this: curl -k -u <YOUR_USER>:<YOUR_PASS> https://<YOUR_SPLUNK_SERVER>:8089/services/authentication/users/<SOME_USER>; -d password=<NEW_PASSWORD> Or if you're using > 7,3 and using token auth you can use: curl -k -H "Authorization: Bearer <YOUR_TOKEN>" https://<YOUR_SPLUNK_SERVER>:8089/services/authentication/users/<SOME_USER>; -d password=<NEW_PASSWORD> ... View more

You can only make GET REST requests from search bar without any additional commands. Do you have access to the management port (8089) to do API requests? Are you wanting to change your own password or someone else? ... View more

tl;dr; 22 icons at https://github.com/livehybrid/splunk_drawio_icons ... View more

Here you go @andrewtrobec - This is what I am currently using. Doesnt have all of them but its a start - let me know if you want others adding and I'll try and add them... https://github.com/livehybrid/splunk_drawio_icons ... View more

Funnily enough I was talking about this just this morning. I'll see if I cna get something uploaded tonight! ... View more

Ive uploaded a new version 1.0.6 which should fix this issue. It was caused by the build pipeline excluding some JS files. Please let me know if you have any other issues. Thanks ... View more

Ive uploaded a new version 1.0.6 which should fix this issue. It was caused by the build pipeline excluding some JS files. Please let me know if you have any other issues. Thanks ... View more

Hi, Im double checking this against 8.0.3 currently, but in the meantime you should be able to access the inputs config at https://yourInstance:8000/en-US/manager/TA-aws-trusted-advisor/data/inputs/aws_trusted_advisor Let me know how you get on. Thanks Will ... View more

Hi, Im double checking this against 8.0.3 currently, but in the meantime you should be able to access the inputs config at https://yourInstance:8000/en-US/manager/TA-aws-trusted-advisor/data/inputs/aws_trusted_advisor Let me know how you get on. Thanks Will ... View more

Hi @sylbaea It looks like you havent configured the app to point to an authentication.conf file with your intended SAML roles in. I'll be writing better documentation for this over the coming weeks, however in the meantime: Navigate to the app's configuration page from the nav bar once within the app. Populate the authorization_conf_url field (badly named!) with a link to your authentication.conf file, along with any auth headers required to get to the url. It must be HTTPS. Once done, try the command again and let me know how you get on! ... View more

Hi, Have you configured this by copying the existing config files from your Windows host, or have you gone through the SAML configuration from scratch in the GUI? Cheers Will ... View more

Hi! Im not sure if any apps currently extract fields from the aws:sqs:securityhub sourcetype. Is this as sourcetype that you have defined in your Splunk instance? If so, does it match what you'd expect to see? Im not familiar with this sourcetype, but is it JSON format? If so, I'd consider adding your own sourcetype and setting kvmode=json Let me know Will ... View more

Hi, Do you have any proxies setup on that instance? If not, does it have outbound port 443 access? ... View more

This application has now been updated to resolve this issue. ... View more