Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kvswathi
kvswathi
Path Finder
Member since:
05-09-2018
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 05-09-2018 |
Activity Feed
- Got Karma for Re: Phantom APPs can not be set.. 06-05-2020 12:49 AM
- Posted Re: custom status update for notable event using phantom playbook on Splunk SOAR. 08-26-2019 10:26 PM
- Posted custom status update for notable event using phantom playbook on Splunk SOAR. 05-31-2019 05:45 AM
- Tagged custom status update for notable event using phantom playbook on Splunk SOAR. 05-31-2019 05:45 AM
- Tagged custom status update for notable event using phantom playbook on Splunk SOAR. 05-31-2019 05:45 AM
- Posted Re: Lookup File data retention Question on Splunk Search. 05-16-2019 03:53 AM
- Posted Re: Issue in Data Parsing for extracting the field . on Getting Data In. 06-05-2018 03:15 AM
- Posted Re: How to search logs for values on multiple lines? on Splunk Search. 05-18-2018 07:29 AM
- Posted Re: create dashboard to monistor windows event logs on Dashboards & Visualizations. 05-18-2018 04:20 AM
- Posted Re: I am not seeing all my indexes with this REST call, what am I missing? on Splunk Search. 05-18-2018 04:13 AM
- Posted Re: Phantom APPs can not be set. on All Apps and Add-ons. 05-16-2018 04:05 AM
- Posted Re: Unable to access Rest API over http in splunk 7.1 on Splunk Dev. 05-09-2018 06:52 AM
- Posted Re: Unable to access Rest API over http in splunk 7.1 on Splunk Dev. 05-09-2018 02:39 AM
- Posted Re: Unable to access Rest API over http in splunk 7.1 on Splunk Dev. 05-09-2018 02:36 AM
- Posted Unable to access Rest API over http in splunk 7.1 on Splunk Dev. 05-09-2018 12:34 AM
- Tagged Unable to access Rest API over http in splunk 7.1 on Splunk Dev. 05-09-2018 12:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
08-26-2019
10:26 PM
Thank you for the update
... View more
05-31-2019
05:45 AM
Hi All,
I have to update the notable event status using phantom. But the status are custom created ones , not the default status available in splunk app for phantom so its is throwing error in playbook "invalid status"
Can any one have a suggestion here to update the custom status.
... View more
- Tags:
- notable-event
- phantom
Labels
- Labels:
-
administration
-
using Phantom
05-16-2019
03:53 AM
Hey , you can try "Search-Driven Lookup" , there you can set retention for a lookup.
https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Createsearchdrivenlookups
... View more
06-05-2018
03:15 AM
Hi ,
You can define the line breaker while indexing data manually from a file. There you can define the identifier for a new line using regex.
... View more
05-18-2018
07:29 AM
Hi ,
I think you can use transaction command with maxspan and get the results,
... View more
05-18-2018
04:20 AM
As I understood from your question, you need to create a dashboard with different windows servers with categories like application, Security,System.
Use the below query , it will list the event count for each sourcetype for each server . Then you can save it as a dashboard , also you can enable drilldown.
index= | chart count by host,sourcetype
... View more
05-18-2018
04:13 AM
Hi,
Try the query, it will list all indexes. Also make sure that you have sufficient permission to view the indexes.
|rest /services/data/indexes/ | table title
... View more
05-16-2018
04:05 AM
1 Karma
Hi,
you can try the following steps , it is mentioned in the README file of phantom app.
You can disable the certificate validation entirely by POSTing to the Splunk REST API
https://splunk-server:8089/servicesNS/nobody/phantom/configs/conf-phantom/verify_certs
with the following as the request body:
value=0
For example, via CURL:
curl -ku 'username:password' https://splunk:8089/servicesNS/nobody/phantom/configs/conf-phantom/verify_certs\?output_mode\=json -d value=0
To re-enable certificate validation, you can post to the same endpoint but change "value" to 1.
Phantom recommends using certificates, and only disabling certificate verification in development
or test environments only. Never disable certificate verification for a production system.
... View more
05-09-2018
06:52 AM
That was my mistake . I had missed to mention the stanza
[sslConfig] before enableSplunkdSSL = false. Thank you so much for your help.
... View more
05-09-2018
02:39 AM
Thanks for your reply.
The url I am trying to access is http://10.X.X.X:8089
The same is working fine with https://10.X.X.X:8089 . But I need it to work on http.
The response I am getting is
This page isn’t working
10.X.X.X didn’t send any data.
ERR_EMPTY_RESPONSE
-Swathi
... View more
05-09-2018
02:36 AM
Thanks for your reply.
The url I am trying to access is http://10.X.X.X:8089
The same is working fine with https://10.X.X.X:8089 . But I need it to work on http.
The response I am getting is
This page isn’t working
10.X.X.X didn’t send any data.
ERR_EMPTY_RESPONSE
-Swathi
... View more
05-09-2018
12:34 AM
Hi ,
I am using the splunk latest version 7.1 . Not able to access the splunk rest API using http even after changing the
enableSplunkdSSL = false in server.conf.
It was working well with previous version of splunk. Any idea about the issue ?
-Swathi kv
... View more
- Tags:
- splunk-enterprise
