Followed this guide properly but not getting any Falcon Indicator events in Splunk and getting the following message in log file     2020-10-16 14:37:04,341 INFO pid=488 tid=MainThread file=splunk_rest_client.py:_request_handler:105 | Use HTTP connection pooling 2020-10-16 14:37:05,289 INFO pid=488 tid=MainThread file=base_modinput.py:log_info:295 | Authentication status code: 201 2020-10-16 14:37:05,289 INFO pid=488 tid=MainThread file=base_modinput.py:log_info:295 | Successfully Retrieved Authentication Token 2020-10-16 14:37:05,563 ERROR pid=488 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-crowdstrike-intel-indicators/bin/ta_crowdstrike_intel_indicators/aob_py2/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-crowdstrike-intel-indicators/bin/crowdstrike_intel_indicators.py", line 77, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-crowdstrike-intel-indicators/bin/input_module_crowdstrike_intel_indicators.py", line 157, in collect_events indicators = intel['resources'] KeyError: 'resources'   Please advise. Thanks.   ... View more

We are setting up Splunk RWI solution and have been request by the Splunk engineer to open ports 4443 and 4444 to allow comms to on-prem HF from their respective public endpoint URLs for Zoom and Teams data. Given that both are cloud based data sources, I was wondering why this cant be done straight on the IDM itself ? ... View more

Can Splunk support staff in one region access customer data residing in Splunk cloud instance of another region ? For e.g can support staff in US region access data in an index of a Splunk indexer which is hosted in Sydney, AU ? ... View more

Whats the alternative when link between on-prem HF to Splunk cloud goes down? how we can we prevent loss of data during the interim? For syslog, we already use syslog server so no issue on that part. However, what can we do for data from non-syslog based sources such as UFs? There is option for Persistent queues but its not available for these input types: Monitor Batch File system change monitor splunktcp (input from Splunk forwarders) ... View more

I have approx. 35k buckets under Fixup Tasks Pending (35k). Under Fixup Category Search Factor Current Status - Missing enough suitable candidates to create searchable copy in order to meet replication policy. Missing={ default:1 } Time in Fixup - 17 hour(s) 8 minute(s) Fixup Reason -  unmet rf Under Fixup Category Replication Factor Status - No possible srcs for replication Time in Fixup - 17 hour(s) 8 minute(s) Fixup Reason - unmet rf Env. details - 3 x Indexers in a cluster, 1 ES, 2 regular non-clustered SHs, 1 DS RF=2 SF=2 Third indexer was just newly added 4 days ago. Can someone please advise the cause of these issues and how I can fix this ? Background - after adding new (third) Indexer, there was some storage issue due to which it went to automatic detention but which we eventually fixed it and brought back to cluster from detention. All Indexers are up and running. After that, to fix the above issue, based on some post I did rolling restart and restarted CM but still no change to the above. ... View more

I am getting the below error message on a new Indexer that I recently added to a cluster (which previously had 2 Indexers)   Search peer NEW_INDEXER has the following message: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch.    Checking disk space on this Indexer, it seems its already filled to 24Gb, whereas, on old Indexers, one is 12GB and other has used 14 GB. Why is there so much difference in disk space used for this directory between all Indexers ? Also, please advise how this can be fixed. (other than just extending the directory space, which I had already requested storage team to increase) ... View more

I am building a REST API input using add-on builder for ingesting logs from Oracle Identity Cloud Service following instructions in the documentation https://www.oracle.com/webfolder/technetwork/tutorials/obe/cloud/idcs/idcs_splunk_obe/splunk.html However, I am not sure where I should use attributes:values from the docs in the REST input wizard in the add-on builder. Can someone please help with this ?   ... View more

Are there any disadvantages of installing Windows Infra app on the ES search head if the SH has 32Gb ram and 24 CPU ? ... View more

After ePO is upgraded to the latest version, a new SQL database is created in addition to the existing ePO database (ePO_Servername) with the format: ePO_Servername_Events . I am getting the results of the SQL query successfully when I chose ePO_servername database as it seems to have all the tables required for join operation as below. • EPOEvents • EPOLeafNode • EPOProdPropsView_VIRUSCAN • EPOComputerProperties • EPOEventFilterDesc However, the DBA says I should use ePO_servername_Events database, but when I use this DB, all I get is the EPOEvents table. I am sure there might be few here who have had to go through this same problem. Can you please share which DB you chose or how you made this work ? Thanks in advance. ... View more

As per the docs, issueReload determines whether the client's splunkd reloads after receiving an update and restartSplunkd determines whether the client's splunkd restarts after receiving an update. Can somebody please explain what happens internally in Splunk when client reloads vs client restarts ? ... View more

Anyone have experience with ingesting Nessus scan data into Splunk with the new Tenable app/add-on ? if yes, please share what "application" type did you choose when configuring the add-on on the configuration page ? Currently it gives three options - Tenable.sc Credentials - Tenable.sc Certificates - Tenable.io Which one do I choose for Nessus ? ... View more

I have Splunk Supporting Add-on for Active Directory 2.1.4 already installed. I noticed with Splunk Add-on for Microsoft Windows 6.0.0, it also includes Splunk Add-on for Windows Active Directory version 1.0.0 and DNS add-on. are both add-ons required at the same or should I uninstall Splunk Supporting Add-on for Active Directory 2.1.4 ? ... View more