Just want to report to everyone, that I have been running eNcore 6.4.3 (with "alwaysAttemptContinue": true,” ) for a few days. Overall it seems more stable... but it has already crashed once with a new error: Decorator    ERROR    Message data too large. Enable debug if asked to do so. Decorator    INFO     Error state. Clearing queue On the positive side, I did get a "Invalid JSON in settings file" error which caused eNcore to stop logging to the estreamer.log, but the normal ingest process continued without any data loss.   Update: The newest version (4.6.3 with alwaysAttemptContinue as true) crashed the day after I posted this. It had been stable for 4 days.    Currently my Splunk inputs is setup to stop eNcore multiple times. By default, it attempts to start up again every two minutes.  This has done an OK job at clearing the queue and restarting eNcore successfully after it crashes.  ... View more

Thanks, yes - please let us know. I think my current record is stable for one week prior to crashing with the "Configure ERROR Invalid JSON in settings file" error. I also have a ticket open with Cisco but as of yet I cannot provide them with the FMC logs so I don't think it will go anywhere.    One thing I found in our environment is that the stop () and status () commands just don't work. I am not sure if the status () command is even supposed to work (doesn't appear to be in the main module for splencore.sh), but there is still  an input for it in default/inputs.conf.... at least the stop command SHOULD work.. At the moment I am considering writing my own stop script and scheduling it for once a day. I actually had my older firePower (3.x) TA scheduled to stop once a day, I found otherwise the volume of IDS events would be slightly less then when compared to the FMC.   ... View more

Just a small comment on your clean command error. The encore/default.conf default file wants to put new data ""uri": "relfile:///data/splunk/encore.log{0}"," "outputters": [ { "name": "Splunk default", "adapter": "splunk", "enabled": true, "stream": { "uri": "relfile:///data/splunk/encore.log{0}", "options": { "rotate": true, "maxLogs": 9999 } However, if you updated like I did, you previously would have generated a "encore/estreamer.conf" with the older location overriding the default. That, that means you either need to change your location or update the clean command path.    ... View more

I am on 6.4.2 and I just had to edit the clean statement to find the events (and I didn't customize the location). I've been scratching my head thinking I must have missed a variable somewhere but then I came across this post... what is going on?... ... View more

Just wanted to comment in solidarity. I upgraded to 4.6.0 on Tuesday. Everything crashed 3 days later with the following error. Everything is WORKING AGAIN with 4.6.2 so far. Thanks! 021-07-02 11:29:13,211 Connection INFO Connecting to 172.26.12.30:8302 2021-07-02 11:29:13,212 Connection INFO Using TLS v1.2 2021-07-02 11:29:13,213 Monitor INFO Starting Monitor. 2021-07-02 11:29:13,213 Decorator INFO Starting process. 2021-07-02 11:29:13,218 Transformer INFO Starting process. 2021-07-02 11:29:13,219 Writer INFO Starting process. 2021-07-02 11:29:13,219 Monitor INFO Starting. 0 handled; average rate 0 ev/sec; 2021-07-02 11:31:13,353 Controller INFO Process subscriberParser is dead. 2021-07-02 11:31:13,353 Monitor INFO Running. 0 handled; average rate 0 ev/sec; 2021-07-02 11:31:13,875 Controller INFO Stopping... 2021-07-02 11:31:13,875 Controller INFO Process 82246 (Process-1) exit code: 1 2021-07-02 11:31:13,880 Decorator INFO Stop message received 2021-07-02 11:31:13,885 Decorator INFO Error state. Clearing queue 2021-07-02 11:31:13,885 Decorator INFO Exiting 2021-07-02 11:31:13,885 Controller INFO Process 82247 (Process-2) exit code: 0 2021-07-02 11:31:13,885 Transformer INFO Stop message received 2021-07-02 11:31:13,891 Transformer INFO Error state. Clearing queue 2021-07-02 11:31:13,891 Transformer INFO Exiting 2021-07-02 11:31:13,896 Controller INFO Process 82249 (Process-3) exit code: 0 2021-07-02 11:31:13,901 Writer INFO Stop message received 2021-07-02 11:31:13,906 Writer INFO Error state. Clearing queue 2021-07-02 11:31:13,907 Writer INFO Exiting 2021-07-02 11:31:13,907 Controller INFO Process 82251 (Process-4) exit code: 0 2021-07-02 11:31:13,907 Monitor INFO Stopping Monitor. 2021-07-02 11:31:14,102 Controller INFO Goodbye   ... View more

It would seem 6.4.0 was released with a couple of bugs. My instance just failed 3-4 days after install. Upgrade to 6.4.2. ... View more

This app can be used to fix the issue at search time splunkbase.splunk.com/app/3490/ ... View more

Option 1: # Would be good to apply only to the ADFS host if possible # props.conf [source::adfs-host] REPORT-windows_broken_json_1200   = windows_broken_json # transforms.conf  [windows_broken_json] FORMAT = $1::$2 REGEX = &lt;(?!(?:headerName|headerValue))([^&/\=]+)&gt;([^&]+)&lt; Option 2: # Props.conf [source::adfs-host] EXTRACT-windows_activity_id       = \<\/System\>\<EventData\>\<Data\>(?<activity_id>[a-fA-F0-9\-]+)\<\/Data\> EXTRACT-windows_adfs_src          = &lt;IpAddress&gt;(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})&lt;/IpAddress&gt; EXTRACT-windows_adfs_user_id      = &lt;UserId&gt;(?<User_ID>[^&]+)&lt;/UserId&gt; EXTRACT-windows_adfs_Target_User  = &lt;UserId&gt;([A-Za-z]{1,5}[\/\\]){0,1}(?<Target_User_Name>[^&]+)&lt;/UserId&gt; EXTRACT-windows_adfs_AuditResult  = &lt;AuditResult&gt;(?<AuditResult>[A-Za-z]+)&lt;/AuditResult&gt; You probably also want to add a lookup with definitions, etc, for these events since they aren't in the Splunk Windows TA.   Could also update your windows_activity_id to the following if you have 40x events which change the order around... EXTRACT-windows_activity_id_1 = </System><EventData><Data>(?<instance_id>[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20})</Data><Data>(?<activity_id>[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20})</Data> EXTRACT-windows_activity_id_2 = </System><EventData><Data>(?<activity_id>[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20}-[a-f0-9]{2,20})</Data> I would also love to know if there is a comprehensive CIM-compliant app for Windows ADFS logs. Using adfs logs - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html ... View more

Were you ever able to resolve this? I've noticed this slowly started happening to one of my more busy servers. ... View more

Were you ever able to resolve this? I am having a similar issue. Splunk is reading AWS s3 .gz files as "����" where as if I download the file to my Linux/HW I can use "gzip -d filename.gz" and it works just fine. As others suggested, it is a single file not a directory.  ... View more

I wanted to provide an answer more specific to the "Microsoft Graph Security API Add-On for Splunk." I just installed this app (Version 1.2.1) and immediately hit this issue in my distributed environment (SHC, IDXC, HFs). It seems the problem is that the app includes: INDEXED_EXTRACTIONS = json KV_MODE = json Since it is recommended to be installed on both the search head and the heavy forwarder, this means the fields are indexed on the heavy forwarder, then again extracted on the SH which results in two values.  I guess you have to options, turn off KVmode on your search head or turn off Index-time extractions. Personally I did the latter by adding this to my heavy forwarder: TA-microsoft-graph-security-add-on-for-splunk/local/props.conf [GraphSecurityAlert] INDEXED_EXTRACTIONS =   ... View more

This ended up being a big within the app, resolved in Version 3.3.1 March 10, 2021 This is a small release with the following bugs fixed: - Local search mapping mapped to wrong field when using Create New from Content Introspection - Fixed a bug where the update would fail based on the data returned - Modified the links to remediate a potential tabnabbing vulnerability - Removed the Highcharts library - Fixed a bug with the sseidenrichment command (Only affects Splunk 8.1) ... View more

I am having a similar issue with any search using the sseidenrichment command. I wanted to additionally comment that, for me at least, this issue started when we upgraded from Splunk 8.0 to 8.1.2. I have not been able to identify a root cause yet. Is anyone else noticing a correlation between this issue and Splunk version 8.1? ... View more

Have you had any better luck with 4.0.11? I had a lot of issues with 4.0.9 (back in Oct-Nov) but at a certain point I was hitting the following errors and  I couldn't ingest data so I had to downgrade.  root         INFO     'View' object has no attribute '_View__isHex' Decorator    ERROR    [no message or attrs]: 'View' object has no attribute '_View__isHex'\n'View' object has no attribute '_View__isHex'Traceback (most recent call last):\n............... I am just noticing my issue seems different than yours but they related it to the same bug   ... View more

Thanks vikramyadav. The only problem is I also ran into this issue on 4.0.7 and enterprise v8. I could downgrade but I hope to move back to 4.x soon after cisco resolves some of the 4.0.9 bugs (they told me they have to resolve CSCvw51040 and I might also be hitting another bug).  ... View more

It appears the automatic update portion only works if you have a paid API key.  ... View more

Encore 4.0.9 crashed after a day (Cisco wasn't able to help) and  I ended up downgrading to 3.x. I got my IP's back! https://splunkbase.splunk.com/app/3662/ ... View more

I am still running into this issue with the newest release, 4.0.9.  For example, if the IP were 69.74.26.104 (which I randomly made up) and the source were 10.0.0.1, the Correlation Event looks like this:   rec_type=112 event_sec=1603290117 policy_uuid=00000000-0000- blocked=No client_id=0 client_version="" dest_ip_country="united states" dest_criticality=None dest_host_type=Host dest_ip=5457451624 est_os_fingerprint_uuid=00000000.............. src_ip=167772161....... ... View more

Thanks for responding - 4.0.7 is available on Splunk base (https://splunkbase.splunk.com/app/3662/), but it is in beta so you have to manually select that version (v3.6.8  comes up by default).  I am playing with it because it is the only version that supports Splunk 8. - The app is reporting decimal instead of ip, similar to your first example - "167837711" instead of 10.1.0.15 - This change started happening exactly when I migrated from 3.6.8 to 4.0.7 rather than an FMC upgrade. I haven't been able to find another other cause. But again, the app is in beta.  ... View more