About erika_horton

erika_horton · ‎05-07-2021

^ that is roughly how I would write the extractions as well. I don't like delimiters, I would punch the sample data into regex101 and write an extraction out where each capture group is everything inside the bracket example: \[BDF\]\s\[(?<error_code>[^\]]+)\]\s\[(?<field2>[^\]]+)\]\s\[(?<field3>[^\]]+)\] Just repeat the pattern until finished.

erika_horton · ‎05-07-2021

I presume you are running this from a UF or HF - do you have access to the forwarder to run a btool? I would start by doing btool on the input to verify the sourcetype configuration isn't getting clobbered there, then I would also btool the props of the sourcetype to see if the time format is correct. Directions: https://docs.splunk.com/Documentation/Splunk/8.1.3/Troubleshooting/Usebtooltotroubleshootconfigurations

erika_horton · ‎05-07-2021

When setting the search schedule from the Phantom Add-on UI, it appears that Splunk defaults to doubling the search time range. You can see this if you navigate to Searches, Reports and Alerts and look at the saved searches under the Phantom add-on. The search will be named "_phantom_app_<configuration name>", so in this case, "_phantom_app_Crowdstrike Detection" If you select "Edit Schedule", you can see the schedule is set to run on cron schedule with the configuration of */10 * * * *, and the Time Range is set to "Custom Time". You can open the custom time and shrink the window here to reduce duplicated events being forwarded to Phantom.

erika_horton · ‎05-07-2021

We are using the Phantom Add-on to forward events from our ES SH to our Phantom instance, but after upgrading to v. 4.035 we have started getting duplicates of all events in Phantom. The configuration was created in the Phantom Add-on UI, and is set to run every 10 minutes.

Posts	4
Solutions	1
Karma Given	1
Karma Received	1
Member Since	‎12-13-2012

Online Status	Offline
Date Last Visited	‎05-07-2021 03:35 PM

Duplicate Events Forwarded to Phantom

Re: Field Extraction with square brackets

Re: Incorrect Timestamp

Re: Duplicate Events Forwarded to Phantom

Duplicate Events Forwarded to Phantom

Are you a member of the Splunk Community?

Duplicate Events Forwarded to Phantom

Re: Field Extraction with square brackets

Re: Incorrect Timestamp

Re: Duplicate Events Forwarded to Phantom

Duplicate Events Forwarded to Phantom