IN my environment i am using python script to sent trap .please find the script below ... Script is working fine using this i am able to generate the incident through tool. For my concern is i have received only one source detail in the incident. i need all the source details what ever available in the column need to sent in trap server . Please help any one... import os import csv import gzip import subprocess import shlex os.chdir(os.path.dirname(__file__)) if __name__ == "__main__": #Read the environment variables that Splunk has passed to us scriptName = os.environ['SPLUNK_ARG_0'] numberEventsReturned = os.environ['SPLUNK_ARG_1'] searchTerms = os.environ['SPLUNK_ARG_2'] queryString = os.environ['SPLUNK_ARG_3'] searchName = os.environ['SPLUNK_ARG_4'] triggerReason = os.environ['SPLUNK_ARG_5'] browserUrl = os.environ['SPLUNK_ARG_6'] rawEventsFile = os.environ['SPLUNK_ARG_8'] #file where you want to write the content logFile = open('D:\Splunk\splunk_alert_events.txt', 'a') #We got the file name from the envioenment vars eventFile = csv.reader(gzip.open(rawEventsFile, 'rb')) #logFile.write(eventFile) i=0 for row in eventFile: if i==0: i+=1 else: myhost=row[2] source=row[3] sourcetype=row[1] logFile.write(myhost + "\n") logFile.write(browserUrl + "\n") logFile.write(scriptName + "\n") logFile.write("queryString" + "\n") logFile.close() logFile = open('D:\Splunk\splunk_alert_trapsDC.txt', 'a') proc = subprocess.Popen(['C:\Windows\System32\VivekB.exe','-d', '10.182.73.70','-v', '1.3.6.1.4.1.4842.200.1.0','STRING',myhost,'-v', '1.3.6.1.4.1.4842.200.1.1','STRING',source,'-v', '1.3.6.1.4.1.4842.200.1.2','STRING',browserUrl,'-v', '1.3.6.1.4.1.4842.200.1.3','STRING',sourcetype,'-v', '1.3.6.1.4.1.4842.200.1.4','STRING',scriptName,'-v', '1.3.6.1.4.1.4842.200.1.5','STRING',queryString,'-v', '1.3.6.1.4.1.4842.200.1.6','STRING',searchName,'-v', '1.3.6.1.4.1.4842.200.1.7','STRING',triggerReason],shell=False) logFile.write(proc + "\n") logFile.close() logFile = open('D:\Splunk\splunk_alert_trapsDR.txt', 'a') prog = subprocess.Popen(['C:\Windows\System32\VivekB.exe','-d', '10.182.73.164','-v', '1.3.6.1.4.1.4842.200.1.0','STRING',myhost,'-v', '1.3.6.1.4.1.4842.200.1.1','STRING',source,'-v', '1.3.6.1.4.1.4842.200.1.2','STRING',browserUrl,'-v', '1.3.6.1.4.1.4842.200.1.3','STRING',sourcetype,'-v', '1.3.6.1.4.1.4842.200.1.4','STRING',scriptName,'-v', '1.3.6.1.4.1.4842.200.1.5','STRING',queryString,'-v', '1.3.6.1.4.1.4842.200.1.6','STRING',searchName,'-v', '1.3.6.1.4.1.4842.200.1.7','STRING',triggerReason],shell=False) logFile.write(prog + "\n") logFile.close() ... View more

in our environment we have 4 servers (A,B,C D) A >>Act as a(indexer ,search head ,license master ,Forwarder management ) B>>Indexer C>>Indexer D>>Indexer we have follow this document for Splunk integration. https://www.splunk.com/blog/2018/05/07/splunking-microsoft-azure-monitor-data-part-2-splunk-setup.html we need to run some script that script will update in Phyton in OS it will impact current running environment? Please any one advice & suggest azure application logs integration options ... View more

We have observed one error from one forwarder server to indexer. Error Message:08-20-2018 13:34:39.963 +0200 ERROR TcpInputProc - Message rejected. Received unexpected 842019128 byte message! from src=192.168.1.71:37694. Maximum message allowed: 67108864. (::) ... View more

In our splunk environment, we have one master node (Master1) and two search head (search head 2 & search head 3) and five indexers (indexer 1, indexer 2, indexer 3, indexer 4 & indexer 5) in all the splunk indexer logs replicate to HMTWSPL05. I have splunk daily volume 500 GB license We are using splunk alerting purpose & saved 5 days logs For me three DR server DR Search head >>>>Search head DR Master node server>>>>master node DR Indexer >>>>indexer How can enable DR setup for this environment, we need live logs also forward DR indexer & saved 5 days forwarder logs Please give a clear picture for me. Suppose that I have forward logs to DR indexer server, does that mean it will also accumulate splunk? ... View more