If you're not using Splunk Enterprise Security, then there is no Notable ID to send to Phantom. In this case, if you're just using Splunk Enterprise (core), you can use an Adaptive Response action that is provided with the Phantom app for Splunk (https://splunkbase.splunk.com/app/3411/) to forward your alerts. You can choose either "Send to Phantom" or "Run Playbook in Phantom". The documentation is at https://my.phantom.us/4.2/docs/admin/splunk ... View more

"indexes_edit" is for the ability to modify the properties of the index. It doesn't change the ability to write data to an index. from the docs at http://docs.splunk.com/Documentation/Splunk/7.1.1/Security/Rolesandcapabilities "indexes_edit Lets the user change any index settings such as file size and memory limits. " ... View more

Yes, where they reside depends on what app context they are saved under. In this case, they were saved while in the default app "Searching & Reporting". ... View more

Provided you're working with a relatively current version of Splunk, you should be able to accomplish this with the html panel visualization element: http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/PanelreferenceforSimplifiedXML#html ... View more

Are you using the Splunk Blue Coat TA or do you have custom log formats you're dealing with? If you're not using the TA, this should help: https://splunkbase.splunk.com/app/2758/ ... View more

As stated, the Splunk real-time output app is no longer available. Here is the official guidance for forwarding data to another system: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd ... View more

There is no need to have a heavy forwarder if you're simply monitoring the Bro log files. Provided you don't choose to use a heavy forwarder, then you have no need to have the technology add-on (TA) on the forwarder. Regarding the Bro source, the only thing you need on the universal forwarder is the inputs.conf file that specifies what you're ingesting. The Bro TA does need to be on the indexer because that's where the basic parsing happens, such as line-breaking and date/time extraction (note that if using a heavy forwarder, that basic parsing happens at the forwarder). The TA also needs to be on the search head for things such as search-time field extraction. All that being said, Splunk will ignore any directives that do not pertain to the level of processing it's doing as part of the data indexing pipeline. So, there is little impact if you want to put the TA at every level of you're Splunk infrastructure, forwarder, indexer, and search head. Here are the gory details if you'd like to dig in further. http://wiki.splunk.com/Community:HowIndexingWorks ... View more

Correct URL: http://wiki.splunk.com/Community:Splunk_Visio_Stencil ... View more

The Splunk app for CEF relies on data models to pull data from, so what you're seeing in the dropdowns are the fields that exist in data models currently defined on your Splunk instance. If the data models that you have do not contain the desired fields, you can always create a new data model that does. ... View more

It appears that there is some process already listening on that port. You can always choose an alternate port for Splunk, which may be easier than changing whatever the other process is. You can check to see what the other process is by running: lsof -i :8000 ... View more

Hi- Take a look at this doc, that should answer your question: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Overridedefaulthostassignments Although you will have to specify a regex and not depend on the KV_MODE extraction of the host name. ... View more

Are you running Splunk on multiple servers? If so, your props and transforms files should reside on the indexer or on the heavy forwarder, if you're using one. ... View more

Can you post the inputs.conf file here and the path where it's located? Also, in your original post, you mentioned something about a JSON.parse error, at what point were you getting that? ... View more

At what point are you seeing the error: "Your entry was not saved. The following error was reported: SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data."? ... View more

The Fortigate app is rather old and doesn't appear to have been tested with the 6.x version of Splunk. You may want to email the author about that and see if it is still under active development. That being said, I don't see anything in the app that would prevent it from working in Splunk 6.x. What version of FortiOS are you using? The readme file in the app says that version 4.0MR3 is supported Try putting a file called inputs.conf in $SPLUNK_HOME/etc/apps/Splunk_Fortigate/local/ with the following contents: [monitor://<full path to your log file>] sourcetype = fortigate After that file is in there, restart Splunk and your log file should be read in and processed. ... View more

You will find a LOT of people willing to help you on this forum. You should add a little more detail and context to your question, to get better responses. Posting sanitized samples of the plaintext log can help. Noting your current Splunk configuration can help (version, stand-alone or distributed, OS, etc). How are you collecting the logs? (syslog, Splunk forwarder, API, etc) What is your level of familiarity with Splunk? ... View more

In the Splunk URL for the dashboard in question, add this on the end: ?showsource=true so, if you were viewing the dashboard weather_stats, it would look like the following: http:// :8000/en-US/app/weather/weather_stats?showsource=true I don't have a 6.0 instance to test with but that will either show you the advanced xml directly or will show you HTML and give you a link to show the advanced xml. ... View more

With simple XML in v6.1.x, it's no longer necessary to use another module to refresh individual panels. There is a refresh option now. For example, in the settings for a chart in 6.x, you could use the following to refresh the chart every 900 seconds: <option name="refresh.auto.interval">900</option> http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML ... View more

What didn't pan out about the SNMP approach? Were you planning to poll the device for information or configure it to send traps to a listener monitored by Splunk? ssh may be a possibility to. ... View more

You are correct that correlation searches utilize the same saved searches that core Splunk does. If you were simply populating dashboards with the results, then correlation searches would not offer a great deal of benefit over simple saved searches. Within the Enterprise Security product, when a correlation search triggers, the result is a "notable event", which can be tracked and managed via workflow, by a security operations team. So, there are the interactive components, useful to a security operations team, that ES offers. Notes can be added to the notable events, ownership can be assigned, as well as status. Of course, this makes no mention of the other features of Enterprise Security, such as integration of threat lists and integration of an environments assets and identities information. ... View more

Forwarders can run a script in any language, given that the proper interpreter is available on the system. Here is some info on the process. Note that you may need to write a small wrapper script to call your main script. http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/Setupcustominputs ... View more

Another option (if the 3rd value is always at the end of the record): (?<value3>[^\>]+)(?=$) ... View more

given that your record looks like this: Apr 3 23:33:25 splunkiron arpwatch: new station 192.168.1.229 80:ea:96:b8:3:e3 You should be able to use this regex: ^(?:[^\s]+\s+){3}(?<host>[^\s]+)\s+(?<process>[^:]+):\s+(?<message>[^\d]+)(?<dest>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+(?<mac>.*) If you provide some log samples and the fields you'd like extracted, I can be more precise. ... View more