About livehybrid

livehybrid · ‎07-09-2020

Are you looking for something to get the data in to Splunk or more the data enrichment? We're using a customised version of the app you mentioned, we took the props/transforms/lookups/tags etc from the app to build our own. We're bringing data in through the method mentioned in the app, which is Cloudwatch events -> Firehose -> HEC and landing it as aws:cloudwatch:guardduty.

livehybrid · ‎07-09-2020

You could drop all data from your custom sourcetype into the nullQueue so that it doesnt reach the indexing queue. The below should help: props.conf [my_sourcetype] TRANSFORMS-ignore = null_queue transforms.conf [nullqueue] REGEX = . DEST = queue FORMAT = nullQueue

livehybrid · ‎07-09-2020

Hi @maxr7866 Sorry about the delay getting back to you on this. If you Inspect the search job and click the splunk.log link, does it give any indication of errors? Does your user have the list_storage_passwords capability? If you're available for a quick screen share to walk through this then please let me know. Thanks Will

livehybrid · ‎06-19-2020

Hi @test_splunk15 , It sounds like you're generating unique HEC tokens on each indexer? If you want to be able to loadbalance your HEC then you will need the same set of tokens on each indexer. If you're using a cluster then you can push these out using your cluster master (create an app in $SPLUNK_HOME/etc/master-apps containing the inputs.conf with your tokens. If you're not using a cluster master then you could deploy out with a deployment server, and if not then you can manually copy the tokens between your indexers. Once done you'll be able to loadbalance your HEC and the token will be accepted on any of the targets the LB hits. I hope this helps, shout if you have any other questions Thanks Will

livehybrid · ‎06-18-2020

Its funny you mention that because I've just done the exact same using AWS LB and ACM. The logging out of Azure isnt particularly helpful. I also ran into the SSL issue - Azure doesnt allow for non-trusted certificate, there doesnt appear to be a flag to disable. For anyone else running into this issue, ensure that you're webhook is publicly accessible with a publicly trusted SSL Certificate and that your Azure application has the correct API permissions to configure. the subscription.

livehybrid · ‎06-16-2020

I ran in to the same problem with this - the webhook has to be externally accessible and must be https! { "notificationUrl": "http://myfqdn:4444", "resource": "/communications/callRecords", "changeType": "created, updated", "expirationDateTime": "2020-06-18T21:36:38Z" } returns: { "error": { "code": "InvalidRequest", "message": "NotificationUrl scheme='http' is not supported.", "innerError": { "date": "2020-06-16T21:36:39", "request-id": "50aa099c-21a1-4531-aeb8-f42596924e24" } } } Azure must also be able to resolve the domain. I hope this helps.

livehybrid · ‎06-14-2020

Did you install a recent version of Splunk 7? I believe the trial licenses might be limited based on when the version is published, rather than when it was installed.

livehybrid · ‎06-14-2020

Unfortunately I think you will lose access to it. It may be worth speaking to the sales team to see if it can be extended? Glad its working!

livehybrid · ‎06-14-2020

Ah fantastic. That will work as long as everybody using your instance isnt coming from the same source IP/Proxy/NAT gateway out of your company, otherwise you will all end up hitting the same SH!

livehybrid · ‎06-14-2020

The first request sounds almost right, but the token has Acknowledgement turned on so need to either turn that off or add a request channel (In curl this would be something like -H "X-Splunk-Request-Channel: FE0ECFAD-13D5-401B-847D-77883AD77131"

livehybrid · ‎06-12-2020

You could look to create a custom alert action and use this to send data out Splunk. https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/ModAlertsBasicExample As you're on SplunkCloud you'll need to make sure that the endpoint you're sending to is SSL to pass the vetting. Alternatively you could look at sending to Graylog's GELF via HTTP from the DBData/REST Lookup app. I think it can be configured to send a payload (e.g. the output of your search) - although I wouldnt suggest this if you have more than a handful of lines to send, but may inspire other options! https://splunkbase.splunk.com/app/4253/

livehybrid · ‎06-12-2020

In that case its unlikely to be firewall related! The other thing I was wondering is could it be connecting on the wrong protocol? e.g. can you confirm that you're connecting with HTTPS if the endpoint is HTTPS? The other thing to check for is any proxies in the way that you might not go through when testing in the CLI - its worth checking in server.conf for a [proxyConfig] stanza, and in /opt/splunk/etc/splunk-launch.conf for any environment variable setting of proxies.

livehybrid · ‎06-12-2020

Hi @ashvini_jain There is some useful documentation here https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/ModAlertsBasicExample which might help with what you're looking for. Custom alerts use stdin to take in the results and can then be parsed and acted upon. I hope this helps.

livehybrid · ‎06-12-2020

Unfortunately this will indeed be as a result of using an NLB which doesnt support the sticky sessions you need (https://docs.splunk.com/Documentation/Splunk/8.0.4/DistSearch/UseSHCwithloadbalancers) Other options you could look at might be using DNS to use a primary SH and using a health-check to create a failover configuration, although this will only give you High-availability rather than spreading of load through the UI. Could you front it with something like HAProxy which could then apply the session persistence?

livehybrid · ‎06-12-2020

Does the customer have an outbound firewall/security group that could be blocking the connection, or a transparent proxy that is filtering/blocking the traffic? If you're using SplunkCloud and connecting to a port other than 443 then you might need to request that it be opened up by CloudOps via a support ticket.

livehybrid · ‎06-11-2020

I might have the wrong end of the stick (apologies)... We collect Cloudtrail (and others) from a number (120+) of accounts into a single index and extract the account id at index time. You can then use tstats to quickly look when an account was last seen... something like this might do it: #props.conf [set_aws_account_id] SOURCE_KEY = _raw REGEX = \"accountId\": \"([0-9]{12})\" FORMAT = aws_account_id::$1 #transforms.conf [aws:cloudtrail] TRANSFORMS-get_aws_account_id=set_aws_account_id Then search: | tstats latest(_time) as latest where index=<your_aws_index> earliest=-24h by aws_account_id | eval recent = if(latest > relative_time(now(),"-5m"),1,0), realLatest = strftime(latest,"%c") | where recent=0

livehybrid · ‎06-10-2020

Before calling requests.post, add something like: if not url.startswith("https"): logger.critical("URL must be HTTPS") exit(1) This way when they vet your app they can see that a non-https url couldnt be used.

livehybrid · ‎06-10-2020

Using Splunk Enterprise you wouldnt be able to do this if you're ingesting through the typical mechanisms. The only thing that I can think of that would allow you to do this is using Splunk Data Stream Processor (DSP) - which allows you to create custom functions to apply to data streams and could be used for encryption/masking etc. https://docs.splunk.com/Documentation/DSP/1.1.0/User/PluginSDK

livehybrid · ‎06-10-2020

Are you already running that script outside the Splunk environment? If so you might want to take a look at sending the result via HEC (https://www.splunk.com/en_us/blog/customers/http-event-collect-a-python-class.html) If not, you could use that code a base for an input by creating an Add-on with the Splunk Add-On Builder (https://splunkbase.splunk.com/app/2962/)

livehybrid · ‎06-10-2020

Are you able to check if there are any logs in the developer console/Firebug? This might suggest a particular page failing to render.

livehybrid · ‎06-10-2020

Would it be possible to create a toggle in the settings of your app for SSL, defaulting to *True* but giving you the option to set to False once uploaded? It does sound a little odd though, If it isnt using SSL when sending to localhost then I'm not sure how they can enforce it for your own app that uses the same mechanism? It might be worth asking for an escalation through support to see if you can come to an agreement with them.

livehybrid · ‎06-10-2020

You could try installing the package locally to the script to see if that makes a difference? pip install -t . pyproj

livehybrid · ‎05-14-2020

@gnangia Please could you try the latest version of the app and let me know if you still have this issue? Thanks

livehybrid · ‎05-14-2020

@shwetas Did you get to the bottom of this? Please feel free to reach out if you still have any issues. Thanks Will

livehybrid · ‎05-14-2020

Please can a moderator merge this with https://answers.splunk.com/answers/822015/splunk-enterprise-803splunk-803.html

Posts	1998
Solutions	287
Karma Given	83
Karma Received	860
Member Since	‎08-15-2013

Online Status	Offline
Date Last Visited	5 hours ago

Issue using Map+ app with _time

Splunk AWS App not populating pricing info for eu-...

Does anybody have a working draw.io Library with S...

Re: Get AWS Guard Duty into Splunk

Re: Run script without sending to index

Re: No Data in Trusted Advisor Dashbaords

Re: set-up hec behind load balancer

Re: MS Teams Add-On Graph subscription fails

Re: MS Teams Add-On Graph subscription fails

Re: splunk 7 ent, 2 days install, Invalid username...

Re: Enable http event collector

Re: Splunk Web UI - Getting "Cannot get username w...

Re: Enable http event collector

Re: How can i send somes logs from splunkcloud to ...

Re: 104, Connection Reset by Peer error

Re: Splunk search results

Re: Splunk Web UI - Getting "Cannot get username w...

Re: 104, Connection Reset by Peer error

Re: AWS Missing feeds

Re: How to pass Splunk Cloud verification for my P...

Re: Can I create an eval function using a python s...

Re: Python script to clock error on splunkd.log on...

Re: Problem: Trying to create auth tokens

Re: Sending email via SSL/TLS using localhost

Re: Import python libraries into script - things d...

Re: Tusted Advisor Proxy connction error

Re: No Data in Trusted Advisor Dashbaords

Re: Install on 8.0.3

Join the Conversation