This is fixed now in version 2.9.2. Thanks for the clear report. ... View more

This particular error should be fixed in version 2.0.3: https://splunkbase.splunk.com/app/2630/ ... View more

Some thoughts below: "suggested to create an app that produces fake alerts with suspicious log files in splunk to maintain admins´s attention on security issues" I think this could have value depending on the circumstances. I would think it would be better for testing the automation though. I happen to know that some customers do generate fake alerts in order to make sure that their tools properly detect the issue (basically using fake alerts as a sort of unit test to the detection logic). This could also be used for training too. Splunk does something like this with its BOTS program ("Boss of the SOC"). "after some research I get the feeling most admins have an opposite issue, having too many false alerts." This is very much true. Admins tend to get a massive volume of alerts and all of them could be security issues. The difficulty is that security alerts are oftentimes a little fuzzy and you cannot have 100% confidence in all of the alerts. This is why you have humans analyze them. I used to be a Security Analyst at a Security Operations Center and well meaning managers would often pop in and start asking about specific alerts on the screen. The conversation would go like this: Manager: points at alert regarding an authentication failure, "how do you know with certainty that isn't a valid attack?" Analyst: "I don't; but I don't see any other activity indicating malicious behavior" Manager: "so you cannot be certain that it isn't an attack, maybe you should escalate it" Analyst: "I could but I would also have to escalate 1,000 other similar alerts and then none of the alerts would get fixed because it would have overwhelmed the IT team and they would just ignore all of them" The fact is that much of security monitoring is a judgment call. If one is not careful, then you could easily generate a contrived situation that the admins miss but could not realistically be escalated anyways (i.e. if they escalated the fake alert, they would also have to escalate thousands of other alerts that are similar but aren't real issues). ... View more

Could you be so kind as to answer the following questions in order to help me troubleshoot the issue: Has the input ever worked? I'm trying to figure out if this is an intermittent error. Do you happen to be using the free license? Does this seem to coincide with Splunk starting or shutting down? Asking because I have seen errors like this happen on startup and shutdown. ... View more

It doesn't support that yet. This was an oversight on my part because I added the port scanning functionality after I had created the previous lookup commands. I opened a ticket to add the ability to do bulk port scans: https://lukemurphey.net/issues/2589 Update: I added the ability to do this in version 1.5: https://splunkbase.splunk.com/app/3491/ See https://lukemurphey.net/projects/network-tools/wiki/Using_Lookups for how to use the lookup. You just need to make sure that the host field (e.g. "10.0.0.1") and the ports field (e.g. "80-1024,8000") are defined. I was testing it like this: (dest=10.0.0.6 OR dest=10.0.1.11) | stats count by dest | eval ports="80,443,8000" | lookup portscan host as dest ports | table ports dest open_ports closed_ports ... View more

This looks like a bug to me. I opened a bug report and will look into fixing it soon: https://lukemurphey.net/issues/2587 My plan is to release a fix in a maintenance release. Update: I have released a fix. The fix is in version 2.9. It is available from Splunkbase here: https://splunkbase.splunk.com/app/1493/ ... View more

I don't support specifying the authentication type yet. I opened a ticket to add this: https://lukemurphey.net/issues/2583 ... View more

Could we get some details about what is happening? Let me know the answers to the questions below and I'll see if I can determine what the issue is. "I am unable to edit or values for a specific field name": are you saying that you cannot edit a particular field (but can others)? What version of the Lookup Editor are you using? Does editing CSV based lookups work? Does the issue only affect this particular KV lookup? Can you try making another KV store lookup and seeing if that works? ... View more

I'm going to fix this so that the app will continue to work on the free license: https://lukemurphey.net/issues/2538 ... View more

The docs are here: https://docs.splunk.com/Documentation/CIM/4.14.0/User/Overview It is pretty simple. You just need to use certain field value, field names and tags. ... View more

I think the only thing you might want to do in that case is to have the data from your search commands stored in CIM format. Other than that, there likely isn't much you would need to do to integrate with ES. I updated the answer accordingly. ... View more

Could you do some searching via the troubleshooting guide here: https://lukemurphey.net/projects/splunk-website-monitoring/wiki/Troubleshooting I'll fix this ASAP if I can get some details that allow me to narrow down the problem. ... View more

I have not updated the app to work with Splunk 8.0.0 yet. I have a ticket open to do the work: https://lukemurphey.net/versions/338 I have the changes in progress and will release it soon. Update: Version 1.0.3 has been released. I confirmed it works it now works on Splunk 8.0.0. See https://splunkbase.splunk.com/app/2630/ ... View more

Can you look though the troubleshooting guide (https://lukemurphey.net/projects/splunk-website-monitoring/wiki/Troubleshooting) and let me know if it reveals something noteworthy? In particular, the following search might be useful for exposing problems: index=_internal (sourcetype=web_availability_modular_input ERROR) OR (traceback AND NOT sourcetype=splunkd_ui_access) ... View more