Adding to my problem, if i add table command then it gives error in rename command and if remove rename command then it throws error for spath command. ... View more

Appreciated. Thanks for the solution and detailed explanation. Regards, Sharukh   ... View more

Dear ITWhisper, Your sol. Sovled my problem but still i have 3 doubt. 1) Whats the difference between join and append commad? 2) For me, why my previous query with join command was not working?  3) the sol. You provided is there any limitations with append command? Like limits on no. Of rows returned and all     ... View more

Thank you for response. I installed the splunk app for service now on my splunk 8.02 I am recveing the error Please find below the error logs 02-27-2020 19:02:05.676 +0530 ERROR AdminManagerExternal - Unexpected error "" from python handler: "HTTP 404 Not Found -- Not Found". See splunkd.log for more details. 02-27-2020 19:02:05.783 +0530 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "C:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\admin.py", line 148, in init\n hand.execute(info)\n File "C:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\admin.py", line 634, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\snow_accounts_handler.py", line 51, in handleList\n account = account_manager.list()[0]\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\snow_account_manager.py", line 64, in list\n return [self.get_by_name("snow_account")]\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\snow_account_manager.py", line 54, in get_by_name\n accounts = snow_account_collection.list()\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\client.py", line 1459, in list\n return list(self.iter(count=count, **kwargs))\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\client.py", line 1418, in iter\n response = self.get(count=pagesize or count, offset=offset, **kwargs)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\client.py", line 1648, in get\n return super(Collection, self).get(name, owner, app, sharing, **query)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\client.py", line 746, in get\n **query)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 287, in wrapper\n return request_fun(self, *args, **kwargs)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 69, in new_f\n val = f(*args, **kwargs)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 665, in get\n response = self.http.get(path, self._auth_headers, **query)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 1160, in get\n return self.request(url, { 'method': "GET", 'headers': headers })\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 1221, in request\n raise HTTPError(response)\nHTTPError: HTTP 404 Not Found -- Not Found\n 02-27-2020 19:02:05.783 +0530 ERROR AdminManagerExternal - Unexpected error "" from python handler: "HTTP 404 Not Found -- Not Found". See splunkd.log for more details. 02-27-2020 19:02:12.086 +0530 WARN LocalAppsAdminHandler - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 02-27-2020 19:02:13.225 +0530 WARN LocalAppsAdminHandler - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 02-27-2020 19:02:13.251 +0530 WARN LocalAppsAdminHandler - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 02-27-2020 19:02:15.683 +0530 WARN LocalAppsAdminHandler - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 02-27-2020 19:02:15.713 +0530 WARN LocalAppsAdminHandler - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 02-27-2020 19:02:16.440 +0530 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "C:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\admin.py", line 148, in init\n hand.execute(info)\n File "C:\Program Files\Splunk\Python-2.7\lib\site-packages\splunk\admin.py", line 634, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\snow_setup_handler.py", line 38, in handleList\n snow_default = self._get_snow_default(service)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\snow_setup_handler.py", line 47, in _get_snow_default\n collection = client.Collection(service,"service_now_setup/snow_account").list()\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\client.py", line 1459, in list\n return list(self.iter(count=count, **kwargs))\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\client.py", line 1418, in iter\n response = self.get(count=pagesize or count, offset=offset, **kwargs)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\client.py", line 1648, in get\n return super(Collection, self).get(name, owner, app, sharing, **query)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\client.py", line 746, in get\n **query)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 287, in wrapper\n return request_fun(self, *args, **kwargs)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 69, in new_f\n val = f(*args, **kwargs)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 665, in get\n response = self.http.get(path, self._auth_headers, **query)\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 1160, in get\n return self.request(url, { 'method': "GET", 'headers': headers })\n File "C:\Program Files\Splunk\etc\apps\splunk_app_servicenow\bin\splunklib\binding.py", line 1221, in request\n raise HTTPError(response)\nHTTPError: HTTP 404 Not Found -- Not Found\n ... View more

I want to create rules/use case/notable/alert that will trigger when they will find the required condition. FOR CYEBRARK. I don't have any idea for use cases, please suggest me some along with conditions For example on windows we have failed login alert that will trigger when it finds 3 device event class id 4625 in 2 minutes. Can anyone please suggest some use cases for cyberarl also ... View more

Could you please share the condition/logic of Use case so that i can implement the same in other SIEM tools ... View more