eventgen's documentation is pathetic. Also: gogen examples skip index names from config files - a basic getting started example is all that was needed! https://github.com/halr9000/gogen-1/blob/master/README/Tutorial.md ... View more

Working Solution***** I worked with a Splunk SME and added the following syntax which gave me a column for target_hash and saved in the input statement without error*** [AnalyzerDetectionMethod] AS [detection_method], [ThreatActionTaken] AS [vendor_action], [ePO_xxxxxxxxxxxx].[dbo].[EPExtendedEventMT].[TargetHash] AS [target_hash], CAST([ThreatHandled] AS int) AS [threat_handled], LEFT JOIN [ePO_xxxxxxxxxxxx].[dbo].[EPExtendedEventMT] ON [ePO_xxxxxxxxxxxx].[dbo].[EPOLeafNodeMT].[AutoID] = [ePO_xxxxxxxxxxxx].[dbo].[EPExtendedEventMT].[EventAutoID] AND (EPOEventFilterDesc.Language='0409')) t WHERE AutoID > ? ORDER BY AutoID ASC ... View more

After the 5.10 schema upgrade, having two databases to modify my table query pointers, and getting the index 1 error, I figured out that you have to unlock the pointer and set it to zero because you are starting the index from scratch and the pointer (AutoID) had no place to start. This fixed my error and allowed me to continue to the last step and save the query. I did have to take the line pull up to 100,000 lines to catch up in a hurry. ... View more

I found that this gives me the text output without a password after following the directions in this URL. http://docs.splunk.com/Documentation/Splunk/7.1.1/Security/Getthird-partycertificatesforSplunkWeb LD_LIBRARY_PATH=/opt/splunk/lib/ /opt/splunk/bin/openssl rsa -in /opt/splunk/etc/auth/mycerts/myprivate.key -text ... View more