About kevinmanson

kevinmanson · ‎06-21-2018

Jason, Can you also expand on the this new app vs Microsoft Azure Active Directory Reporting Add-on for Splunk https://splunkbase.splunk.com/app/3757/

kevinmanson · ‎05-27-2018

To the developer please remove the macro's from TA-crowdstrike/default/eventtypes.conf. macros.conf is normally not replicated to indexers. This is why it works in stand-alone and not with a distributed search to indexer or cluster. You can add macros to replicate to indexers in distsearch.conf, or better yet just remove the macro from eventtypes.conf as its not needed. [crowdstrike_detection] search = sourcetype="crowdstrike:falconhost:json" metadata.eventType=DetectionSummaryEvent [crowdstrike_authentication] search = sourcetype="crowdstrike:falconhost:json" metadata.eventType=AuthActivityAuditEvent [crowdstrike_change] search = sourcetype="crowdstrike:falconhost:json" metadata.eventType=UserActivityAuditEvent [crowdstrike_action] search = sourcetype="crowdstrike:falconhost:ar" [crowdstrike_query_detection] search = sourcetype="crowdstrike:falconhost:query:json" source="/detects/entities/summaries/GET/v1" [crowdstrike_query_indicator] search = sourcetype="crowdstrike:falconhost:query:json" source="/indicators/entities/iocs/v1?ids=" [crowdstrike_query_device] search = sourcetype="crowdstrike:falconhost:query:json" source="/devices/entities/devices/v1?ids="

kevinmanson · ‎05-27-2018

Getting the error below in the 1.0.3 version of the Technology Add-on for CrowdStrike. ERROR SearchParser - The search specifies a macro 'cs_get_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information. ERROR TsidxStats - Error in 'SearchParser': The search specifies a macro 'cs_get_index' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information.

kevinmanson · ‎05-01-2018

Koshyk, Any luck on being able to send over that table?

kevinmanson · ‎04-30-2018

Reformatted sentence into question.

kevinmanson · ‎04-27-2018

Do Cisco ASA NGFWs aka X-series and firepower series sending logs to FMC and collecting via estreamer provide equal or greater logging within Splunk over syslog from the ASA? Meaning everything event visible in syslog can be seen in the estreamer feed in some way. One of the other concerning issues is the size of the events syslog is 200bytes/event while estreamer is 2000bytes for connection events.

kevinmanson · ‎01-02-2018

Any updates yet? it's been well over 2 years?

kevinmanson · ‎09-28-2017

Same problem here. Below is the end of the splunk log file from TEMP. the last error before removing is DS init failed: Deployment Server not available on a dedicated forwarder Successfully processed 31 files; Failed processing 0 files HTTP/1.1 200 OK Date: Thu, 28 Sep 2017 14:49:38 GMT Expires: Thu, 26 Oct 1978 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, max-age=0 Content-Type: text/xml; charset=UTF-8 X-Content-Type-Options: nosniff Content-Length: 1930 Connection: Close X-Frame-Options: SAMEORIGIN Server: Splunkd /services/apps/local 2017-09-28T10:49:38-04:00 <name>Splunk</name> 0 30 0 <s:msg type="INFO">Restart required by: default-mode, limits, server, web</s:msg> DS init failed: Deployment Server not available on a dedicated forwarder. Removing service SplunkForwarder Service removed Disabled.

kevinmanson · ‎08-10-2015

Aversion to using shutti? Isn't that a dead project? How is Splunk cloud doing this for warm buckets? Splunk Cloud’s backup/archiving process encrypts customer data within separate Simple Storage Service (S3) buckets using AES 256-bit encryption. Keys are rotated on a routine basis and are under continuous monitoring. Archiving takes place when customer hot buckets roll to warm buckets, a process that regularly occurs based on every 10GB of data ingested or every 24 hours (whichever comes first)

kevinmanson · ‎07-28-2015

Splunk, Please tell me there is a bug created for this issue and it is going to be resolved at some point.

Posts	10
Solutions	1
Karma Given	9
Karma Received	5
Member Since	‎07-21-2015

Online Status	Offline
Date Last Visited	‎06-16-2020 04:27 AM

ERROR SearchParser - The search specifies a macro ...

Estreamer vs syslog from ASA firewalls

Re: Difference with Splunk Add-on for Microsoft Cl...

Re: ERROR SearchParser - The search specifies a ma...

ERROR SearchParser - The search specifies a macro ...

Re: Estreamer vs syslog from ASA firewalls

Re: Estreamer vs syslog from ASA firewalls

Estreamer vs syslog from ASA firewalls

Re: Windows DNS debug logs TA not using CIM fields...

Re: Splunk 7.0 installation failed to complete

Re: How to put cold and frozen data on s3 in AWS

Re: sendemail does not issue STARTTLS properly wit...