Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About arthurbreuer
arthurbreuer
Path Finder
Member since:
11-13-2012
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-13-2012 |
Activity Feed
- Got Karma for Re: How can I get the Bro-events in my own index (and not in the index "bro")?. 06-05-2020 12:46 AM
- Posted Re: REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 02-09-2015 12:50 PM
- Posted Re: REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 02-06-2015 09:27 AM
- Posted Re: REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 02-06-2015 05:54 AM
- Posted Re: REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 02-05-2015 03:06 AM
- Posted Re: REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 02-02-2015 06:35 AM
- Posted Re: REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 01-31-2015 03:43 PM
- Posted REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 01-30-2015 08:40 AM
- Tagged REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 01-30-2015 08:40 AM
- Tagged REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 01-30-2015 08:40 AM
- Tagged REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 01-30-2015 08:40 AM
- Tagged REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 01-30-2015 08:40 AM
- Tagged REST API errors with AMQP Messaging Modular Input add-on on All Apps and Add-ons. 01-30-2015 08:40 AM
- Posted Re: When can we expect an updated version for Add-on for Bro IDS? on All Apps and Add-ons. 10-17-2014 01:14 AM
- Posted Re: When can we expect an updated version for Add-on for Bro IDS? on All Apps and Add-ons. 07-20-2014 06:50 AM
- Posted When can we expect an updated version for Add-on for Bro IDS? on All Apps and Add-ons. 07-20-2014 06:28 AM
- Tagged When can we expect an updated version for Add-on for Bro IDS? on All Apps and Add-ons. 07-20-2014 06:28 AM
- Posted Re: How can I get the Bro-events in my own index (and not in the index "bro")? on All Apps and Add-ons. 06-13-2014 08:03 AM
- Posted How can I get the Bro-events in my own index (and not in the index "bro")? on All Apps and Add-ons. 06-12-2014 02:36 AM
- Tagged How can I get the Bro-events in my own index (and not in the index "bro")? on All Apps and Add-ons. 06-12-2014 02:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
02-09-2015
12:50 PM
Hi Pkhalsa,
You are right. The last line has to be commented out, so it should look like this: #jdk.tls.disabledAlgorithms=SSLv3.
Is it possible that you have more that one java installed?
... View more
02-06-2015
09:27 AM
Hi Damien,
Good news this time! The problem is that SSLv3 is disabled in Java by default. The same problem is mentioned in http://answers.splunk.com/answers/209379/no-appropriate-protocol-protocol-is-disabled-or-ci.html
The only thing you have to do is to enable SSLv3 (if this is possible off course). Just add a comment ('#') in front of the last line of the file "java.security". You can find this file in the directory:
OpenJDK : /usr/lib/jvm-java--openjdk-.x86_64/jre/lib/security
Oracle SDK : /usr/java/jdk/jre/lib/security
If you agree that this is the solution, maybe you can make a note in your documentation?
And again, thank you for your help.
... View more
02-06-2015
05:54 AM
It looks like SSLv3 is enabled. But still the errors appear.
server.conf
[sslConfig]
enableSplunkdSSL = true
useClientSSLCompression = true
useSplunkdClientSSLCompression = true
supportSSLV3Only = true
sendStrictTransportSecurityHeader = true
allowSslCompression = true
allowSslRenegotiation = true
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
sslKeysfile = server.pem
sslKeysfilePassword = XXXXXXXXXXXXXXXXXXXXXX
caCertFile = cacert.pem
caPath = $SPLUNK_HOME/etc/auth
certCreateScript = $SPLUNK_HOME/bin/splunk, createssl, server-cert
web.conf
[default]
[settings]
startwebserver = 1
httpport = 443
enableSplunkWebSSL = true
supportSSLV3Only = true
... View more
02-05-2015
03:06 AM
Any ideas Damien?
... View more
02-02-2015
06:35 AM
Hi Damien,
The server is part of a domain. Localhost is resolved correctly. Ping, traceroute, wget, everything works.
When I link localhost to a non existing IP, the following error appears:
02-02-2015 15:21:15.716 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/amqp_ta/bin/amqp.py" Probing socket connection to SplunkD failed.Either SplunkD has exited ,or if not, check that your DNS configuration is resolving your system's hostname (xxxx.xxxx) correctly : Connection refused
And later, the two errors appear again:
02-02-2015 15:21:17.313 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/amqp_ta/bin/amqp.py" Can't connect to Splunk REST API with the token [Splunk XXXXXXXXXXXXXXXX], either the token is invalid or SplunkD has exited : Connection refused
02-02-2015 15:21:27.314 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/amqp_ta/bin/amqp.py" It has been determined via the REST API that all inputs have been disabled
Our server virtualized and is running on Splunk version 6.1. I also tested it on Splunk version 6.2.1 on a testserver. As for Java, I tried it on Java openjdk 1.7.0_75 and Java SE 1.8.0_31 (Oracle).
... View more
01-31-2015
03:43 PM
Hi Damien,
Thank you for your reply. The problem is that splunkd is still active. When I only restart the add-on the one item from the queue is added to Splunk and the same errors appear again.
Regards,
Arthur
... View more
01-30-2015
08:40 AM
I am using the AMPQ add-on on a RabbitMQ queue. Splunk version is 6.1.
When the add-on starts the next two errors appear in the splunkd.log:
01-29-2015 18:16:51.995 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/amqp_ta/bin/amqp.py" Can't connect to Splunk REST API with the token [Splunk XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX], either the token is invalid or SplunkD has exited : No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
01-29-2015 18:17:01.997 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/amqp_ta/bin/amqp.py" It has been determined via the REST API that all inputs have been disabled
The data from the queue is added to the index in Splunk. As far as I can see all REST API functions are working fine.
Do you have any idea what the problem is?
... View more
10-17-2014
01:14 AM
Hi, it would be nice that when a new version of bro gets out, the add on for Bro gets updated too. If the output format is changed, then the add on should be updated or else it would not work anymore. And it would be very nice if new features are available too.
... View more
07-20-2014
06:50 AM
Or is it simply not necessary to update the app because of the flexible setup? Like with the autotype solution?
... View more
07-20-2014
06:28 AM
When can we expect an updated version for the Splunk Add-on for Bro IDS?
The current version only supports Bro v2.2 and Bro v2.3 is already out for some time now. And I think the next version(s) will be out soon. Is this something Splunk is working on as a new version of Bro comes out?
... View more
06-13-2014
08:03 AM
1 Karma
I think I found the problem. The setting for the index was overruled by the "BroRouteIndex" setting in the file "default/transforms.conf". I commented it out and now the index property in the inputs.conf isn't ignored anymore. It looks like the data is going to the proper index now.
... View more
06-12-2014
02:36 AM
I am using the Splunk Add-on for Bro IDS to parse pcap files, get the metadata from them as bro logfiles and parse these logfiles into a Splunk index.
The problem I have is that I only can put the data in a dedicated index "bro". But I want to be able to put the data in my own index and not in this bro index.
I tried so things with no result. It is possible to name an index in the input.conf, but this only works for the sourcetype "pcap_monitor" and not for the sourcetypes "bro_*". I also tried to monitor the logfiles separately with an named index, but the data still ends in the bro index. I also changed the index.conf file in the apps directory, but this doesn't make any difference too.
In the documentation of the "All Bro events are stored in a dedicated index named bro." There is nothing on how to put data in another index. So it looks like it is not possible?
Any ideas?
... View more
