Is it me or are the extractions in Splunk_TA_mcafee-wg next to totaly wrong? To take an example Log entry from some of my activity the log looks like this: Jul 18 08:44:27 xxx_hostname_xxx mwg: McAfeeWG|time_stamp=[18/Jul/2018:08:44:27 +0200]|auth_user=cn=XXXX,ou=XXX,ou=XXXX,ou=XXX,o=XXX|src_ip=10.9.16.6|server_ip=172.217.22.100|host=www.google.com|url_port=443|status_code=200|bytes_from_client=958|bytes_to_client=426|categories=Search Engines|rep_level=Minimal Risk|method=GET|url=https://www.google.com/searchdomaincheck?format=domain&type=chrome|media_type=text/plain|application_name=Google|user_agent=Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36|referer=|block_res=0|block_reason=|virus_name=|hash=|filename=searchdomaincheck|filesize=426| for src, src_ip,user,user_agent the value is "unknown" There is the field auth_user containing the dn but i think user should contain the cn... What am i doing wrong? ... View more

i have a script that generates a csv under /var/run/splunk I would like to update my lookup file I read the docs and it says to post a request like this: response = requests.post('https://localhost:8089/servicesNS/nobody/SA-cve/data/lookup-table-files/cve.csv', data=payload, verify=False, headers=headers) where headers are like this: headers={'Authorization': 'Splunk xXxXxXXXxXXXy','Content-Type': 'application/json'} and the data is like this: {'eai:data': '/opt/splunk/var/run/splunk/cve.csv'} i can read that endpoint like (excerpt): <entry> <title>cve.csv</title> <id>https://localhost:8089/servicesNS/nobody/SA-cve/data/lookup-table-files/cve.csv</id> <updated>2018-02-02T15:57:56+01:00</updated> <link href="/servicesNS/nobody/SA-cve/data/lookup-table-files/cve.csv" rel="alternate"/> <author> <name>nobody</name> </author> <link href="/servicesNS/nobody/SA-cve/data/lookup-table-files/cve.csv" rel="list"/> <link href="/servicesNS/nobody/SA-cve/data/lookup-table-files/cve.csv/_reload" rel="_reload"/> <link href="/servicesNS/nobody/SA-cve/data/lookup-table-files/cve.csv" rel="edit"/> <link href="/servicesNS/nobody/SA-cve/data/lookup-table-files/cve.csv" rel="remove"/> <link href="/servicesNS/nobody/SA-cve/data/lookup-table-files/cve.csv/move" rel="move"/> and it looks ok but post failes with >>> print response <Response [500]> >>> print response.text <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR"> In handler 'lookup-table-files': Data could not be written: /nobody/SA-cve/lookups/cve.csv: /opt/splunk/var/run/splunk/cve.cvs</msg> </messages> </response> ... View more

It seems to me that a python script (custom command and/or controller have no write permission under /etc) Is this me making a mistake or is this a default setting and if so, can it be overcome? (maybe not due to security considerations) I realize that for a search head cluster this could be non trivial . ... View more