About richardphung

kruane · ‎12-10-2021

Having some trouble here. I was using this to setup things up: https://www.youtube.com/watch?v=8pH_XRjPMjM Steps Completed: 1.) Created Index 2.) I've add the Splunk Connect for Zoom 3.) Installed Splunk App for Zoom For Zoom: 1.) I've gone into Zoom and now have an administrative account. 2.) Went to: https://marketplace.zoom.us/ 3.) I completed the information about the setup, company name, username etc. 4.) The trouble occurs on the last part where you enable the "Event subscriptions". It will not accept my url. Not exactly sure why. I tried various ways and it keeps saying "invalid url"

richardphung · ‎04-26-2021

An interesting turn of events.. It looks like the events ARE being indexed.. but instead of Object Type: computer, Object Name: hostname, they are coming in as: Object: Object Server: DS Object Type: %{bf967a86-0de6-11d0-a285-00aa003049e2} Object Name: %{fbdc83b5-af6f-4dd2-8256-458e8e1348e2} Handle ID: 0x0 Not sure why... In the local event viewer, it is resolving the GUID

mtaher · ‎11-03-2020

@atammana_splunk I'm running into a situation about the error: "Appserver: Running Splunk Web in legacy mode by setting appServerPorts=0 has been deprecated." If I comment out that line in local/web.conf, then the values in default/web.conf is used, and splunkweb does not start If I comment them out in both places, I get a warning about "appServerPorts = 0". If I set "appServerPorts = 8065" or some other unused value, splunkweb did not start Splunk version is: 7.3.1 Any thoughts on it would be helpful.

richardphung · ‎09-16-2020

from my splunkd.log: 09-16-2020 15:44:31.022 -0400 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/cloudlock/bin/cloudlock.py" InsecureRequestWarning) 09-16-2020 15:44:31.272 -0400 INFO ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/cloudlock/bin/cloudlock.py" Received HTTP Code: 200 09-16-2020 15:44:31.276 -0400 INFO ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/cloudlock/bin/cloudlock.py" CloudLock: 100 new incidents found 09-16-2020 15:44:31.331 -0400 INFO ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/cloudlock/bin/cloudlock.py" CloudLock: Getting last incidents from 2020-03-10T17:50:36.979766+00:00 (offset 100) 09-16-2020 15:44:31.333 -0400 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/cloudlock/bin/cloudlock.py" /opt/splunk/lib/python2.7/site-packages/urllib3/connectionpool.py:851: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings 09-16-2020 15:44:31.333 -0400 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/cloudlock/bin/cloudlock.py" InsecureRequestWarning) 09-16-2020 15:44:31.367 -0400 INFO ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/cloudlock/bin/cloudlock.py" Received HTTP Code: 429 09-16-2020 15:44:31.367 -0400 ERROR ExecProcessor - message from "/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/cloudlock/bin/cloudlock.py" 429 Client Error: TOO MANY REQUESTS for url: https://api.cloudlock.com/api/v2/incidents?count_total=false&updated_after=2020-03-10T17%3A50%3A36.979766%2B00%3A00&offset=100&order=updated_at&limit=100 This looks like it's working.. just no events in index.

marcluescher · ‎09-14-2020

same issue here. we are currently trying to use direct REST API calls to get some of the data in Splunk v8

michaeljorgense · ‎06-18-2020

@jlsabaut it looks like the migration to new Splunk Answers might have lost the attachment you provided with tips on setting this up. Would you mind re-sharing please? @richardphung I would also prefer to send this to a syslog server and not direct to Splunk so thanks for asking my question for me. But it sounds like from the answer for the Avaya Call app to work it's not in syslog format. Possibly can have the Avaya system export syslog in another way? Just not on the SMDR screen.

richardphung · ‎06-12-2020

Greetings--- I have Wireless logs that I am attempting to create a Timechart, splitting by Area, and displaying stacked by AccessPoint. Here is my base search: index="wlan" EventType=Authentication | rex field=AP (?<=AP-)(?<area>.*?)(?=-) | eval area = upper(area) Ideally, I would like to create a Trellis of ... | timechart dc(Mac) AS count by AP grouped by the field area. I see loads of examples on answers... this is the closest that I get: https://community.splunk.com/t5/Splunk-Search/Timechart-count-by-ip-by-fw-name-over-time-with-trellis/m-p/498737 So with this, I get.. index="wlan" EventType=Authentication | rex field=AP (?<=AP-)(?<area>.*?)(?=-) | eval area = upper(area) | bucket span=30m _time | stats dc(Mac) AS count by _time area AP | eval {AP}=count | fields - AP count Which is VERY close.. My trellis is grouped by area, and it displays my bar chart over time. However, it 1) does not support stacking, and 2) does not seem to filter the legend... in my case, I have around 10 areas and 160 APs., and each chart in the trellis by area displays correctly, but it also displays the all 160 APs in the legend space per chart. Any help is appreciated.

richardphung · ‎02-10-2020

index="shib" | where isnull(user) | search "net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152" And there it is... a similar search: index="shib" "net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152" user 100 Values, 100% of events

richardphung · ‎01-29-2020

This may be trivial... I have a REST API URL: ...api.thiswebsite.com/client/v4/xxxxxxxxxxxxxxx/logs?start=(date-time-format)&end=(date-time-format) The date-time-format they are requesting is RFC-3339 format: e.g. 2020-01-29T17:00:21Z The json that is returned looks like this: {"ClientIP":"XXX.XXX.XXX","EndTimestamp":"2020-01-29T17:18:47Z","ResponseBytes":11627,"ResponseStatus":200,"StartTimestamp":"2020-01-29T17:18:47Z""} Ideally, the start and end times would increment... But I am unsure how to do this with the Add-On builder. https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/ConfigureDataCollection https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/ConfigureDataCollection#Use_checkpoints_for_incremental_data_collection Checkpoint parameter name Checkpoint field path Checkpoint initial value Please advise.

richardphung · ‎01-28-2020

After installing the Accellion dashboard app, all searches now display a warning re: Unable to find tag.

richardphung · ‎01-24-2020

@LukeMurphey This fixed everything.

richardphung · ‎01-23-2020

Used this: http://localhost:8000/en-US/app/google_drive/google_drive_logs?redirect_to_custom_setup=0 It appears to bypass the configuration page.

richardphung · ‎01-06-2020

We are planning an upgrade. Our current environment: Splunk Enterprise Core - 7.1.4 Enterprise Security - 5.1.1 Splunk Add-On for Microsoft Windows - 5.0.1 Splunk Add-On for Microsoft Active Directory - 1.0.0 Our target for this maintenance window is proposing to bring this to: Splunk Enterprise Core - 7.3.3 Enterprise Security - 6.0.0 The question is do we need to also plan to upgrade the Splunk Add-On for Microsoft Windows from 5.0.1 to 6.x/7.x? As well as deprecate Splunk Add-On for Microsoft Active Directory at the same time? or will these continue to work, and we can plan for a future deployment of the latest supported MS-Add-Ons?

LukeMurphey · ‎11-26-2019

I have not updated the app to work with Splunk 8.0.0 yet. I have a ticket open to do the work: https://lukemurphey.net/versions/338 I have the changes in progress and will release it soon. Update: Version 1.0.3 has been released. I confirmed it works it now works on Splunk 8.0.0. See https://splunkbase.splunk.com/app/2630/

richardphung · ‎11-07-2019

With Security Essentials, I get an error: [Indexer] Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'PrivilegedRiskScores' does not exist or is not available. Must have a risk index Error This search presumes the presence of Splunk Enteprise Security to provide the Risk Framework. Reach out to your Splunk team to find out more about Splunk ES, or adapt this search for your own list of risk events. There is, indeed, index="risk" And the Risk Analysis Datamodel exists. However, there is no defined Automatic Lookup with "Privilege"

richardphung · ‎11-05-2019

This is a copy of that event: Nmap 7.70 scan initiated Tue Nov 5 13:28:51 2019 as: nmap -oG - -v -R -sP -PE 192.168.13.0-255 Ports scanned: TCP(0;) UDP(0;) SCTP(0;) PROTOCOLS(0;) Host: 192.168.13.0 () Status: Down Host: 192.168.13.1 () Status: Up Host: 192.168.13.2 () Status: Down [...] Host: 192.168.13.232 () Status: Down Host: 192.168.13.233 () Status: Down Host: 192.168.13.234 () Status: Down Host: 192.168.13.235 () Status: Down Host: 192.168.13.236 () Status: Down Host: 192.168.13.237 () Status: Down Host: 192.168.13.238 () Status: Down Host: 192.168.13.239 () Status: Down Host: 192.168.13.240 () Status: Down Host: 192.168.13.241 () Status: Down Host: 192.168.13.242 () Status: Down Host: 192.168.13.243 () Status: Down Host: 192.168.13.244 () Status: Down Host: 192.168.13.245 () Status: Down Host: 192.168.13.246 () Status: Down Host: 192.168.13.247 () Status: Down Host: 192.168.13.248 () Status: Down Host: 192.168.13.249 () Status: Down Host: 192.168.13.250 () Status: Down Host: 192.168.13.251 () Status: Down Host: 192.168.13.252 () Status: Down Host: 192.168.13.253 () Status: Down Host: 192.168.13.254 () Status: Down Host: 192.168.13.255 () Status: Down

aleksandrovk · ‎09-27-2019

This doesn't solve the issue

lakshman239 · ‎08-22-2019

My suggestion is that you map your field values to one of - allowed/blocked/deferred for CIM complaince. this way the Security Domain -> Malware Center/Search/Operations dashboard will all be fine. Any searches using datamodel/tstats should also be fine.

richardphung · ‎07-11-2019

This worked perfectly. Thanks!

bhargavnariyani · ‎06-19-2019

Agree with @adonio. If you want to keep everything in a single place, better move it to Windows TA.

richardphung · ‎06-13-2019

Apparently, all I needed was a little more time. About 20 minutes later, I get: Verify admon Object data: SUCCESS - Found ActiveDirectory(admon) baseline (Sync) Object Data View: admon Verify Search ObjectType Total Unique Objects Last Received Event Time Verify Collection and Completion User 14332 06/13/19 12:52:51 Baseline Collection Completed (17 Minutes Ago) Computer 2389 06/13/19 12:52:51 Baseline Collection Completed (17 Minutes Ago) Group 1079 06/13/19 12:51:50 Baseline Collection Completed (18 Minutes Ago) Organization Units 123 06/13/19 12:45:19 Baseline Collection Completed (25 Minutes Ago) Group Policies 92 06/13/19 12:45:19 Baseline Collection Completed (25 Minutes Ago) Containers 23 06/13/19 12:44:15 Baseline Collection Completed (26 Minutes Ago) Domains 1 06/13/19 12:52:06 Baseline Collection Completed (18 Minutes Ago)

rvany · ‎08-13-2019

The Splunk App for Windows Infrastructure comes with a predefined role winfra-admin . The sole purpose of this role is to set the indexes msad , perfmon , windows and wineventlog as "Indexes searched by default. So the user who works with the Windows-App has permission to see all the events in these indexes. If you do not have or use Splunk App for Windows Infrastructure , just create some simliar role and assign this to your user - then you should be fine without changing any of the out-the-box-reports, -macros and dashboards for the MS Windows AD Objects -App. Here is the content of the default authorize.conf : [role_winfra-admin] srchIndexesDefault = msad;winevents;windows;wineventlog;perfmon

richardphung · ‎05-24-2019

I see this update was added on 05/04. Do you have release notes?

lakshman239 · ‎05-18-2019

you would need to ensure that your asset lookup table has all the assets in your organization [ which can come in any events, e.g Malware, network etc..]. Similary you need to capture all users in identity. Once this is available, when you use any TA's [ e.g. symantec], you can validate if the data is getting extracted using CIM /datamodel, e.g. | from datamodel:"Authentication.Authentication" will show all fields extracted. If a field [ e.g user or dest] is not extracted, you will need to add/update in local/props.conf of the add-on/app which you are using [ in this case for you symantec TA]. once this is done, all should work.

jamesbrock · ‎06-12-2019

To show the dashboards directly from the UI once you have the app installed. Configure -> General -> Navigation Create a new collection. Maybe call it "Investigators". Add new Views: Investigate Identity Artifacts - "ident_by_name" Investigate Asset Artifacts - "asset_artifacts" Investigate File/Process Artifacts - "file_artifacts" Drag new views to the collection panel. Save and refresh screen. It will be on the toolbar.

Posts	92
Solutions	4
Karma Given	3
Karma Received	17
Member Since	‎04-17-2018

Online Status	Offline
Date Last Visited	‎07-03-2023 03:38 PM

WinEventLog WhiteList 4662

Troubleshooting Cisco Cloudlock Data Input

Group by Multiple - TimeChart Question

Workday Support for 8.x

web legacy mode detected as blocker

User=unknown in Authentication DataModel

REST Incrementing Start & End

Tag Issue with Accellion Dashboard App

AuthenticationFailed during Import

Logging for App

Re: COVID-19 response: Is Splunk able to ingest lo...

Re: WinEventLog WhiteList 4662

Re: web legacy mode detected as blocker

Re: Troubleshooting Cisco Cloudlock Data Input

Re: Workday Support for 8.x

Re: Splunk as SMDR Listener

Group by Multiple - TimeChart Question

Re: User=unknown in Authentication DataModel

REST Incrementing Start & End

Tag Issue with Accellion Dashboard App

Re: AuthenticationFailed during Import

Re: Logging for App

Question RE: Enterprise Security Compatibility wit...

Re: Unable to Upload API Key

Lookup: 'PrivilegedRiskScores' is missing

Re: REGEX only returning top-line of nmap results.

Re: MultiStage Sankey Diagram Count Issue

Re: CIM malware actions

Re: Asset lookup with conditional eval

Re: [admon://] Stanza

Re: MS Windows AD Objects: "Warning - No ActiveDir...

Re: MS Windows AD Objects: Built-in macros not wor...

Do we have release notes for 2.17.1?

Re: Asset Lookup in Malware Datamodel

Re: How to integrate SA-Investigator with ES