About lakshman239

lakshman239 · ‎09-09-2022

As of the latest version, 1.9.2 (Jun 2022), it still fails for python3 in the upgrade readiness app. Hope app owner reviews and provides us an updated version.

lakshman239 · ‎03-10-2022

Answering my own - Had to edit the LookupEditorhandler javascript file to TRIM the values passed to the json handler file.

lakshman239 · ‎03-01-2022

@beano501 My recommendation would be not updating the datamodel as much as possible. One way to achieve what you are looking is to using the 'src_interface' and 'dest_interface' fields in https://docs.splunk.com/Documentation/CIM/5.0.0/User/NetworkTraffic . Populate these fields with your values from the firewall logs, which can then be used in your searches. Additionally the mapping can also be used via lookup table to enrich data as necessary. Additionally, I would also suggest you to capture all your firewalls in a lookup within the ES Assets, using appropriate values in 'category' (e.g. internal_fw, external_fw, dmzfw etc..). This would then be available both in your searches and in your datam

lakshman239 · ‎02-22-2022

Hi, When using lookup editor app (https://splunkbase.splunk.com/app/1724/), it allows the user to save fields with leading and trailing spaces. Is there a plan to update the app to trim them and/or alternatively is there a quick fix, apart from user training? thanks laks @lmurphey_splunk - Any thoughts pls? thx

lakshman239 · ‎09-15-2021

@soumyasaha25 Normally, if you have access to the UI, You should be able to move/clone the correlation search/knowledge objects (KO) from one app to another app. This would move all the dependent KO's as well. But if you have a lot to do and have access to conf files, you can copy the contents from diff apps to your new custom app and delete after testing/validation. You don't need to add import in local.meta, as you can make your app's permission to 'global/system'. ES no longer selectively imports app/TA/SA-*. You can have dispatch context as ES if you want. Test/check splunkd.logs/btool for any errors after migration and restarting the instances.

lakshman239 · ‎09-08-2021

Something like this will do in Splunk Core or ES. index=_internal (sourcetype=splunkd OR sourcetype=scheduler) log_level="ERROR" |rex field=_raw "savedsearch=(?<mysaved_search>.+) err=" | rex field=_raw "savedsearch_id=\"(?<mysavedsearch>.+)\", message=\"Error" | stats count by host, mysaved_search You can then adjust as per your setup and perhaps setup an alert/correlation search to show you errors from macros/lookups within the correlation search in ES.

lakshman239 · ‎09-03-2021

did this setup work in the past? If so, has there been any changes to IP/host/dns resolution and/or firewall/connectivity? looks like connectivity/resolution issue

lakshman239 · ‎09-03-2021

stop-all running for long time does indicate an underlying issue in the cluster. Have you run the pre-check and post health checks using the latest available scripts? If not, please run them and perhaps raise a case with support attaching the output.

lakshman239 · ‎09-03-2021

@SamHTexas you can look at index=_internal (sourcetype=splunkd OR sourcetype=scheduler) log_level="ERROR" to see all failures in the correlation search due to issues in macros or lookups. You can then tune the SPL as needed for your environment. Hope this helps.

lakshman239 · ‎09-03-2021

@inayath_khanin1 The above error indicates that during the asset merge process, you have one of the 'key' entries exceeding the multi-value limit setup in the AssetFields page under 'Asset and Identity managent' UI ( you can access in the ES app via Configure -> Data enrichment -> Asset and Identity managent). Look at the all the key fields and the multi-value limit. Additionally, you can also check something like this (pick up any field you want to test, e.g. ip which has a mv limit of 6 by default |`assets` | eval my_mvcount = count(ip) | stats count by my_mvcount | where my_mvcount > 3

lakshman239 · ‎09-03-2021

@dominikatvastli - Perhaps this could help, to understand the dependency on the datamodel for each dashboard. https://docs.splunk.com/Documentation/ES/6.6.0/Admin/Dashboardrequirements . You normally don't need to include the index=MyIndex in your eventtypes.conf, sourcetype alone will do, unless you want the index. Also, I assume the index is added to the Spunk_SA_CIM/local/macros.conf for cim_Change_indexes.

lakshman239 · ‎09-03-2021

@grodaas I don't think non-english is supported. However, Windows event logs in XML format is supported (will be in english by default). If you need local language support, please raise with your account team and/or raise an enhancement support/request case.

lakshman239 · ‎09-03-2021

@vr2312 - Assuming, you created an add-on, say, "TA-org-alert", within that directory, that name will be referred in a number of python files and .conf files (e.g. app.conf). If you want to change the name, rename in all the places, remove the .pyc files and restart splunk.

lakshman239 · ‎09-03-2021

@snisaxena One option would be stop and start all services, so they start gracefully. Pls refer to - https://docs.splunk.com/Documentation/UBA/5.0.4.1/Admin/CLICommands

lakshman239 · ‎06-07-2021

What's your ES version and Splunk enterprise version.? I have n't seen this issue in ES 5.3.1, 6.x. You may also want to raise a case with support, if its only occurring on specific version.

lakshman239 · ‎06-07-2021

@tkbrown - If you can add a category against all these internal IPs which want to exclude in your assets/identities for ES, you can use the 'src_category' to exclude them in the above rule. Hope this helps.

lakshman239 · ‎06-07-2021

@phil_wong You would probably want to check the source- threat list activity for the duration that had unknown and find out which event is causing this? its most likely sending 'null' and causing this. If you can fix that, that could avoid 'unknown's coming in the rule/correlation searches. hope this helps.

lakshman239 · ‎06-07-2021

@acadea - We upgraded to 6.4.1 and I noticed the change in the 'release notes' - threat performance improvements - https://docs.splunk.com/Documentation/ES/6.4.0/RN/Enhancements . The ES Configuration health check will also complain about this. So, if you can remove the deprecated links/navigations, or restore the default navigation with 6.4.0 and add your custom changes to the ES navigation. This should fix your navigation errors. Hope this helps.

lakshman239 · ‎05-19-2021

Where in Incident Review dashboard, do you see the issue? In title, description, notable? Generally all these should work with $fieldname$. If its in the Incident review field values pane, then ensure the field is available as described in https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Customizenotables Hope this helps.

lakshman239 · ‎05-19-2021

Not sure what you mean by ' Search Heads are not reported to deployer'.? I assume you are are setting up the deployer and SHC from scratch as per the doc - https://docs.splunk.com/Documentation/Splunk/8.2.0/DistSearch/SHCdeploymentoverview The only thing I notice is you are using http instead of https in conf_deploy_fetch_url http://deployerIPaddress:8089. Is the deployer not running https? is the SHC status healthy? whats the output of the kvstatus command? If you create a lookup in one of the SHC member via UI, does that get replicated to the other 2 members? If so, replication of lookups/knowledge objects works [ you can test for dashboards etc..] Have you then followed up the doc to connect to cluster master/indexers?

Posts	655
Solutions	70
Karma Given	14
Karma Received	60
Member Since	‎07-05-2016

Online Status	Offline
Date Last Visited	‎09-09-2022 12:22 PM

Can whitespaces be trimmed when using lookup edito...

Url parser - logs doesn't rotate

Update default/props.conf with TA-eStreamer

Splunk Add on for PA - incorrect tagging of Networ...

Metrics definition errors in the add-on - is fix a...

Can you help me with an issue using macros and inp...

eStreamer logs from Active - Passive Sourcefire se...

Why doesn't splencore.sh with clean up doesn't wor...

Why do I see a script error when then the data is ...

why do we not have setup.xml in add-on's created b...

Re: URL Toolbox

Re: Can whitespaces be trimmed when using lookup e...

Can I inherit from the CIM Model?

Can whitespaces be trimmed when using lookup edito...

Re: Migrate ES correlation rules to a custom app

Re: How do I find a list of Correlation Searches i...

Re: Splunk UBA is down

Re: Splunk UBA is down

Re: How do I find a list of Correlation Searches i...

Re: Asset and Identity management multi valued

Re: CIM: event goes to node All_Changes instead of...

Re: Splunk UBA and support for windows event log i...

Re: Unable to rename app - Splunk Add On Builder

Re: Splunk UBA is down

Re: Tokens in notable event titles and description...

Re: Omit IP addresses from SPL

Re: How to ignore unknown objects in Risk adaptive...

Re: Error after update - Threat Intel

Re: Tokens in notable event titles and description...

Re: Working with Search Head cluster - Replication...