Hello, Deep Security manager is sending traffic to splunk and splunk is getting the events but not showing it on UI. For example I see DSM sending messages on UDP port 10702 that are received by Splunk but I can't see them. Splunk has the Deep Security manager app configured. Please help? ... View more

For creating your own certificate with OpenSSL, you should specify the "Common Name" *.example.com instead of server1.example.com or web.example.com while generating the certificate signing request (CSR). It will secure your all sub-domains under the example.com. It is recommended to use trusted CA signed certificate for reduce the risk from future cyber attacks. ... View more

Ok thanks, that works for me. I followed your example for a lookup file, that I put in $SPLUNK_HOME/etc/system/lookups/ I put in transforms.conf file ($SPLUNK_HOME/etc/system/local/): [geoloc] filename = geoloc.csv And finaly use the lookup and the geostats command in research. Thanks again! ... View more

Building on @chrisG's post, the app's documentation points to some installation instructions: https://splunkbase.splunk.com/app/1611/#/documentation ... View more