Hello all, I have an issue setting up the LEA pull for Check Point logs. The only thing unusual in my environment, particularly given the errors about passAuth, is that I'm running the free version of Splunk. I go through the installation process without issue, but when I hit the last step (providing the SIC name and the Entity SIC name), I click submit and get no response at all (no errors, no logs, etc.). I've tried restarting, tried going back and resubmitting the previous page (both of which work without an error message), and tried listing my OPSEC connectors which produces a /fail page. When I search for the logs, I see a bunch of the following messages (seeming to roughly correlate to each time I clicked the submit button): 2013-07-22 08:25:13,491 ERROR [51ed4ed8e7ab62378c] <string>:449 - opsec_lea_ui_controller: unable to create scripted input for opsec config HomeProductionEvents - error: passAuth user does not exist: splunk-system-user and then I also see a few of these messages, which seems to correlate with trying to view the existing connections: 2013-07-22 08:28:02,267 WARNING [51ed4f8203ad590b0c] <string>:115 - opsec_lea_ui_controller: problem retreiving opsec config HomeProductionEvents Any ideas for how I could troubleshoot or resolve this? ... View more

I've something of a challenge: How to best generate a single event in a summary index that is based on a transaction across four different fields when there is not a 1:1 relationship across all the fields. I'm trying to do a summary index with mail flow information across Exchange and Cisco Ironports. The Ironports have a MID field that is specific to each message, and an ICID and a DCID that is specific to each Incoming Connection and Destination Connection. I'd initially done a transaction MSGID MID ICID DCID , but then discovered that the ICID and DCID can be used by multiple MIDs. I know I can solve this by generating an enormous table of all ICIDs, DCIDs and the information I want from them, then tossing that into a lookup table via |outputlookup , but having to run that as a scheduled search that will always complete before the primary summary indexing search seems very ugly. Is there a better way? ... View more