you cannot modify the content of an external resource. You cannot do this because of cross-site scripting restrictions. If the html file that you're trying to embed under your control then change it in the source. the other option is to write the html body using javascript ... View more

yes, it is possible. On Desktop (Windows/Linux/Mac) via script alert (deprecated) action (taken from https://answers.splunk.com/answers/2228/audio-alerts-on-client-browser-is-it-possible.html 😞 start "c:\music\my song.mp3" Using browser only: https://www.splunk.com/en_us/blog/tips-and-tricks/audible-alerts.html ... View more

Please don't forget to select "Accept as a solution" if this reply resolves your query! ... View more

if the file has a large header then CRC can be an issue. You may need to set initCrcLength. try to run this command in elevated command prompt (as admin): c:\programfiles\splunk\bin\splunk.exe list inputstatus ... View more

thank you @surekhasplunk for an update 1) information messages related to tcpdump 2) if all crashlogs have "CallbackRunnerThread" as a cause it could be splunk fault and an update can help 3) - good luck with troubleshooting! ... View more

if on linux - additionally you can try to correlate the output of the "last" command, which lists all linux users with corresponed login and logout times, with the time when the "./splunk restart" command was issues. That will not work if you have several simultaniously logged users. I think you need TA_nix Addon to get this info. On Windows you need to check security log to get similar information (using Addon for Windows) ... View more

the script output can be buffered and not flushing to the file system immedially. This especially the case if your script produces a small output only. Try to google "flush stdout your_script_language" ... View more

checking manually the url (https://splunkbase.splunk.com/app/4250/release/1.10.0/download/?origin=cfu) the real reason for the first error is that there is not such app version 1.10.0 currently available (as of today 21 Mar 2020). The last available Cloud Gateway version is 1.9.1. This can be a temporary issue (for example Splunk removed this version). You can restart Splunk and try again. The second error caused by a process accessing the file you trying to update, could be a Windows-specific.... 😞 ... View more

check the manifest file and post the output of this command: grep users.ini $SPLUNK_HOME/splunk*manifest check file ownership and permissions of users.ini and users.ini.default files: ls -l $SPLUNK_HOME/etc/users/users.ini* check logs for related warnings and errors: grep users.ini $SPLUNK_HOME/var/log/splunk/*log ... View more

so you have a login form where you have to enter your username and the password and a user preferences menu on the top, which should usually contain three options: Account Settings, Preferences and Logout. All of them are present except of Logout option? Can you double check your license? Settings > Licensing Are you the only one user on this Splunk? Have the logout option been ever available or is it missing from the start? ... View more

I don't think it is possible, but I can suggest a workaround: You can mask passwords with SEDCMD command during the ingestion and send it to one index and send unmodified events into other index, which can be accessed by you only. Let me know if it solves your question. If not - try to describe your use case so may be somebody can give your better solution. ... View more

such lists (example: https://urlhaus.abuse.ch/browse/) often contains full urls with http:// prefix. A url http://www.example.com/ from the csv file will not match https://www.example.com/foo?xx in your proxy log. It is better to extract the domain part (www.example.com or even example.com) before searching. ... View more

in most cases there are no need to run UF as root user, most common excuses: permissions to access root-only files - can be relaxed using chmod, chown, unix groups, chattr, setcap etc. permissions to open ports below 1024 - can be fixed with iptables, or dropping permissions after start selinux/apparmor - can be adjusted most severe disadvantage - security risk because of: increased attack surface any/most security restrictions (file permissions, even SElinux etc) can be disabled or bypassed etc. ... View more

"complete uninstall" can still leave some files in /opt/splunkforwarder. Try this: sudo /etc/init.d/SplunkForwarder stop # OR systemctl stop SplunkForwarder ps aux|grep -i splunk # to be 100% sure there are no splunk processes running sudo rm -r /opt/splunkforwarder # or any other folder where you've had it installed sudo apt-get install /tmp/splunkforwarder*deb /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 1 systemctl start SplunkForwarder sudo su - splunk /opt/splunkforwarder/bin/splunk add forward-server <splunk>:9997 # or use deployment server / deploy an app /opt/splunkforwarder/bin/splunk list forward-server let us know if it worked ... View more

the fact, that you get permission denied error after you ran chown indicate some other process modified the files afterwards, this could be just a running as root splunk process. You must frist stop spunk and then run the chown command. But... scratch that! Instead of tinker with linux permissions do it right from the beginning: the only command(*) you need to execute as root during splunk administration is splunk enable boot-start -user splunk optionally with "-systemd-managed 1" if you run it on a systemd-enabled system. After that, you have to use su - splunk to switch to splunk user (or similar command) and work as a restricted splunk user only. Why not login as splunk user directly from the start? Many splunkd admins do so, but it is better to leave this account without OS password so nobody except root can login. By doing so you effectively reducing the attack surface. (*) - of course you need modify file permissions, disable THP, adjust limits etc as root before and during you work with splunk, but it is linux admin operation, not splunk administration 🙂 ... View more

transaction is a slow command because it breaks map reduce. You can speed up transaction search by using following options (https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/transaction): endswith, maxspan, maxevents, startswith try these first: maxspan=1m maxevents=20 ... View more

please post results of these searches sourcetype=cisco:wsa:w3c host=A| head | table host, src_ip, _raw and sourcetype=cisco:wsa:w3c host=B| head | table host, src_ip, _raw ... View more

try to use LINE_BREAKER instead of BREAK_ONLY_BEFORE: [lala_pop] DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)PING\s+\d+\.\d+\.\d+\.\d+ NO_BINARY_CHECK=true the difference between BREAK_ONLY_BEFORE and LINE_BREAKER: BREAK_ONLY_BEFORE = <regular expression> * When set, Splunk software creates a new event only if it encounters a new line that matches the regular expression. * Default: empty string : LINE_BREAKER = <regular expression> * Specifies a regex that determines how the raw text stream is broken into initial events, before line merging takes place. (See the SHOULD_LINEMERGE setting, below.) * The regex must contain a capturing group -- a pair of parentheses which defines an identified subcomponent of the match. * Wherever the regex matches, Splunk software considers the start of the first capturing group to be the end of the previous event, and considers the end of the first capturing group to be the start of the next event. * The contents of the first capturing group are discarded, and are not present in any event. You are telling Splunk software that this text comes between lines. * NOTE: You get a significant boost to processing speed when you use LINE_BREAKER to delimit multi-line events (as opposed to using SHOULD_LINEMERGE to reassemble individual lines into multi-line events). * When using LINE_BREAKER to delimit events, SHOULD_LINEMERGE should be set to false, to ensure no further combination of delimited events occurs. * Using LINE_BREAKER to delimit events is discussed in more detail in the documentation. Search the documentation for "configure event line breaking" for details. * Default: ([\r\n]+) (Data is broken into an event for each line, delimited by any number of carriage return or newline characters.) ... View more

does setting smtp server in savedsearches.conf helps? ... View more

OK, so the logs are already encrypted/notreadable before they are pushed? You've wrote above the logs have txt extension. You have to check the IAM vendor's documentation how to make logs readable. Does this diagram reflect your situation, are the logs encrypted/nonreadable from the beginning and you try to use Splunk to decode them? [IAM (encrypted, .txt-extension)] -> via FTPS -> [Splunk forwarder (encrypted, .txt-extension)] ... View more

you have to increase (or set to zero for this sourcetype) TRUNCATE in props.conf for the first example if the length can exceed 10000 bytes. the probability that the regex find a wrong match is higher for a very long line (depends on your regex). from the other side, Splunk best practices are to keep mulitline events to a minimum: https://dev.splunk.com/enterprise/docs/developapps/logging/loggingbestpractices/#Keep-multi-line-events-to-a-minimum ... View more

Make sure you're sending logs to port 22 (sshd daemon), not to splunk forwarder directly. Splunk doesn't support SSH/SCP/SFTP natively. You have to save logs on the hard disk and point the forwarder to the folder where they are stored to read them. ... View more