haha, don't feel dumb; it isn't necessarily obvious. ... View more

Yeah, it is easy. Here is an example (against lukemurphey.net): | traceroute lukemurphey.net You can then saved the search and schedule it per https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/Schedulingsearches You would need a second search to evaluate the results and alert to changes. ... View more

Part of the reason that this app exists is because fschange has been deprecated since 2012 (if I recall correctly). The input is going to be supported as long as Splunk 4.3 is supported; it might be removed then. ... View more

This is now fixed in version 3.3.2. ... View more

I looked into supporting this. Unfortunately, this would only be possible with the Pro version of Handsontable which would be prohibitively expensive. I would be willing to implement it of someone else could get a license but this is likely not going to be cheap since it would need to be the OEM license: https://handsontable.com/pricing ... View more

Can you please help determine if there is some similarity between the lookups that will not load? I can likely fix this quickly once I figure out why they are not loading. Things to look for would be: Are the lookups in a particular app? Are the lookups owned by a particular user? Do the lookups have some characters in the name that might account for the error (e.g. "All lookups with a parenthesis in the name cannot be loaded")? ... View more

Linux/Unix does not allow non-root users to open a port less than 1024 by default. See https://www.geeksforgeeks.org/bind-port-number-less-1024-non-root-access/ for details on how to get around this issue. ... View more

I'm wondering if the OS is disallowing the port to be opened because Splunk isn't running as root. You could test this by changing the port to something above 1024 (like 2022). Let me know if that works. ... View more

This would likely be something caused by an underlying Splunk problem. In this case, the Website Monitoring app is saying that it is unable to talk to Splunkd implying something else is wrong. ... View more

A lookup is the way that I would suggest doing it. I tested this and got this to work pretty easily. Here is how I did it: Step 1: make a lookup file I made a lookup file with two columns: dest approved You can specify a value of "1" in the approved column to drop the destination from the search. Step 2: update the search to use the lookup file Next, I updated the search to use the lookup and drop the entries that match it: | tstats `summariesonly` count from datamodel=Network_Resolution where DNS.dest_category != dns_server AND DNS.src_category != dns_server by DNS.src DNS.dest | `drop_dm_object_name("DNS")` | lookup dns_exception_list dest | search NOT approved=1 Note that the lookup I created was called "dns_exception_list". It drops any entries where the 'approved' column has a value of '1'. ... View more

I have tried to reproduce this but it has been working for me. Can you check the lookup named "web_ping_inputs.csv" and see if the removed input is in the lookup? Also: could you let me know what version of the app you are using? ... View more

This can happen when Splunk is being shut down. You can safely ignore it if it seems to happen when Splunk is being shut down or restarted. ... View more

I would love to take credit for this but I can't think of anything that would have fixed this. I had tried to update the libraries but ran into lots of issues. Thus, I put it aside for now. ... View more

This has been fixed in 3.3.1. See https://splunkbase.splunk.com/app/1724/ ... View more

The links should all work now. ... View more

Tables are kind of tricky. I do think that parsing the data in Splunk's search language is the way to go. 1. Use webscrape search command and Search commands to index parsed data You could use the webscrape search command along with some search commands to get the data and get it into the format you want. Then you could use the collect command to persist it the index you want in a fully parsed state. 2. Store the data in a separate index, then use a search to parse and reindex that data into the final index Another approach would be to create an input to get the data and store it in a separate index and then use a scheduled search to parse the results and moved the parsed results to the index where you want the final data. 3. Use a search to parse the results directly Finally, you could just the UI top create the input and then use some search commands each time you review the data that will parse out the matches (like you are currently doing). ... View more

You can use the secure storage endpoint to store passwords securely. See the following blog post: https://www.splunk.com/blog/2011/03/15/storing-encrypted-credentials.html This is a little tricky because to make it work you need to: Change the modular input to load the password from secure storage Change the UI so that it loads and saves the password from/to secure storage Change the modular input to load the password from secure storage I wrote a modular input wrapper library that includes functions for accessing secure storage (see https://bit.ly/2GK0VQv). I use this in the Website Input app (see the use of get_secure_password in https://github.com/LukeMurphey/splunk-web-input/blob/master/src/bin/web_input.py). Change the UI so that it loads and saves the password from/to secure storage I wrote some modules that make this a little easier, see https://bit.ly/2J57v6X. That project includes a module named secure_password_storage which helps users make a custom manager page which loads and saves the password securely. See an example here: https://github.com/LukeMurphey/splunk-web-input/blob/master/src/default/data/ui/manager/data_inputs_web_page.xml Unfortunately, apps with a custom input page will be rejected by app-inspect and thus cannot be installed on Splunk Cloud (since app-inspect incorrectly thinks that a custom input page is a deprecated technology called advanced XML). Of course, your app will be rejected if you store passwords without secure storage and thus you are stuck either way. ... View more

Did you recently do the upgrade? I'm wondering if some of the old Javascript is being cached. ... View more

@tdlr: that's weird. What kind of Splunk install are you running this on (platform, heavy forwarder/lightweight forwarder/universal forwarder/search head/etc)? ... View more

Version 2.7.4 has a solution for this. The app now includes the ability to be told not to use the proxy server even if you have a proxy server defined using environment variables (often in $SPLUNK_HOME/etc/splunk-launch.conf) but you don't want the Website Monitoring app to use it. To get around this, define a value for the proxy_ignore setting in website_monitoring.conf. You can also set this using the setup page for the Website Monitoring app. Set the value of the "Server Ignore List" to "*", like this: ... View more

Oh awesome! Thank you so much for tracking this down. I wrote up a bug and play to fix this soon: https://lukemurphey.net/issues/2373 ... View more

This means that there are two savedsearches.conf files in different apps that both provide modifications to the "Endpoint - Outbreak Observed - Rule" search. It is best not to have two conf files overriding the same saved search from different apps because this can cause conflicts that cause some of the customizations to appear be overridden. This is easy to fix though. To fix this, go to the filesystem on the search head (or deployer if using SHC). You would likely do this by accessing the search head via SSH (assuming you are using Linux). Open the file $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/savedsearches.conf and find the entry for "Endpoint - Outbreak Observed - Rule". Move this entry to $SPLUNK_HOME/etc/apps/SA-EndpointProtection/local/savedsearches.conf in order to put it in the same app as the one where the search was defined. ... View more