@SimonO Yes.I've used Splunk HEC token and configured it on Prisma to capture prisma alerts data to Splunk. If you want to go with HEC then use Splunk Integration option on Prisma . But my recommendation would be, as the data is coming from cloud to on premesis you can place proper SSL cerificates to get this done work properly. I'd place certificate for HEC like this splunk_httpinput/local/inputs.conf [http] disabled = 0 enableSSL = 1 serverCert = /opt/splunk/etc/auth/certs/prisma-cert.pem ... View more

@sarweins The Splunk App for Salesforce will give you better visibility to monitor all operational activities, analyze trends and user behavior, with extensive reports and dashboards for application management, adoption and usage analytics and security. This App provides deep insight into three categories: - Application Management - Adoption and Usage Analytics - Security Sample dashboards that come with the app: - Detect security threats by analyzing login patterns - Prevent data loss by monitoring Report exports, accessed documents, previews, etc - Perform trend analysis for all access to salesforce by user, group, regions - Detect problems in your Salesforce reports and dashboards - Detect problems with your Salesforce Apex custom classes, queries, triggers, APIs - Salesforce Adoption and Usage Analytics Please check the below links and you will get an idea what can Splunk do with Salesforce. https://www.splunk.com/blog/2015/01/21/splunk-app-for-salesforce.html https://www.youtube.com/watch?v=YRMwyqpa-3Y https://splunkbase.splunk.com/app/1931/ ... View more

Please check the below link https://www.aplura.com/wp-content/uploads/splunk_common_ports.pdf ... View more

@jcleary47 Check Splunk internal ssl certificate expiration on enterprise server. If it is expired the add-on didn't collect any data from Office 365. User below command: $SPLUNK_HOME\bin\openssl x509 -enddate -noout -in $SPLUNK_HOME/etc/auth/server.pem ... View more

You can still use that Document for configuration purpose. It doesn't matter whether you're using Splunk 6.x OR 7.x Yes the FireEye app is currently supporting Splunk 6.x as per Splunk base but still you can use this for Splunk 7.x. Try to use app FireEye recommended sourcetypes so that you'll see all the field extractions properly. ... View more

TA-Exchange-Mailbox - AddOn-Exchange-Mailbox:(C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking]) This is the data input and field extractions for an Exchange Mailbox Role. It is used in conjunction with Splunk for Exchange. There is add-on “Microsoft Office 365 Reporting Add-on for Splunk” available in Splunk base that collects Message Trace data from Microsoft Office 365. https://splunkbase.splunk.com/app/3720/ ... View more

You can configure syslog-ng on Heavy Forwarder but make sure the server should have sufficient resources. Here is the link for configuring syslog-ng with Splunk. https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html Hope this helps.. ... View more

find and kill any lingering processes that contain "splunk" in their name kill -9 `ps -ef | grep splunk | grep -v grep | awk '{print $2;}'` and then perform splunk service restart/start as splunk Hope this helps.... ... View more

Check the below links: https://www.splunk.com/blog/2011/11/09/splunkgit-part-1.html https://www.splunk.com/blog/2011/11/09/splunkgit-part-2.html https://www.splunk.com/blog/2011/11/17/splunkgit-part-3.html https://www.splunk.com/blog/2011/11/18/splunkgit-part-4.html hope this helps... ... View more

Check the following link......it may help you. https://answers.splunk.com/answers/609126/ssl-error-while-trying-to-connect-to-splunk-web-fr.html ... View more

You must be entering the password correctly if not Salesforce account gets locked. Contact your Salesforce admin/architect they will unlock it for you. And also try to follow below link to setup Salesforce account in Splunk. https://splunkbase.splunk.com/app/1931/#/details ... View more

What is the sourcetype you used in syslog monitor inputs , it should be "infoblox:file" You need to install Splunk_TA_infoblox on your HF/Indexers, hope this will fix. ... View more

Check the below Splunk answer: https://answers.splunk.com/answers/658841/db-connect-not-working.html ... View more

Did you see any error warning messages under settings page? ... View more

Yes it's compatible with all CIM 4.x(4.0 to 4.12.0) versions..Please see the above screenshot. ... View more

Sort command sorts a report to give you top 10 MAX values based on "-tmp_GB" field. Glad it worked out for you. Please don't forget to close the ticket if you dont have any further questions . ... View more

We recently upgraded Splunk_TA_windows on all enterprise servers and clients to 5.0.1 from 4.8.3 . We've bunch of clients which were running with 6.5.* and 6.6.* versions . So far we're not seeing any issues and also it is updating how source and sourcetypes are assigned to WinEventLog data. For more details please look here: http://docs.splunk.com/Documentation/WindowsAddOn/5.0.1/User/Upgrade#WinEventLog_extraction_changes WinEventLog extraction changes The Splunk Add-on for Windows v5.0.x updates how source and sourcetypes are assigned to WinEventLog data. Sourcetype changes for WinEventLog data All WinEventLogs are assigned to either the WinEventLog or the XmlWinEventLog sourcetype and distinguished by their source. Version 4.8.4 and earlier source Version 4.8.4 and earlier sourcetype Version 5.0.x source Version 5.0.x sourcetype WinEventLog:System WinEventLog:System WinEventLog:System WinEventLog WinEventLog:Application WinEventLog:Application WinEventLog:Application WinEventLog WinEventLog:Security WinEventLog:Security WinEventLog:Security WinEventLog WinEventLog:System XmlWinEventLog:System XmlWinEventLog:System XmlWinEventLog WinEventLog:Application XmlWinEventLog:Application XmlWinEventLog:Application XmlWinEventLog WinEventLog:Security XmlWinEventLog:Security XmlWinEventLog:Security XmlWinEventLog The sourcetypes WinEventLog:System, WinEventLog:Application, and WinEventLog:Security in the Splunk Add-on for Windows version 4.8.4 or earlier will remain the same for already indexed events. For newly indexed events from the Splunk Add-on for Windows version 5.0.x, the sourcetypes will be changed as shown in the table above. Backwards compatibility for indexed events Due to this change, events that have already been indexed will not be extracted properly so add the appropriate stanzas to rename already indexed events at search-time in props.conf. For already indexed events you can modify your searches, alerts, dashboards, etc., by simply changing “sourcetype=WinEventLog:source” to “sourcetype=wineventlog” (case sensitive). For new searches, alerts, dashboards, etc., use “source=WinEventLog:source” instead. Hope this helps. ... View more

Check the below answers: https://answers.splunk.com/answers/235768/not-able-to-whitelist-windows-events-logs.html https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html ... View more

Limits for controlling disk space in Splunk can be changed The relevant stanza and parameter of interest in server.conf ($SPLUNK_HOME/etc/system/local/server.conf) is: [diskUsage] minFreeSpace = 500 For more details please look here: https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Setlimitsondiskusage Hope this helps. ... View more