This should be higher up. Correct solution.  ... View more

Hi Chris,   I know this is years later but I'm curious if you found a solution for this? I don't believe there's an app related to this yet? ... View more

Just wanted to add that we experienced this issue as well with splunk 9.1.4 and 9.1.5.  Thanks for this info this was down for over a month for us! ... View more

Hi all splunk instances should accept nullQeue. But you must define this parameter/transformation on the first full splunk instance from UF/data source to indexers. It could be HF or indexer.   r. Ismo ... View more

Chris, That's what I'm trying to accomplish as I was able to define what is using the rule so I can start putting defined rules in front of it. In this case I was hoping that someone could help me easily know what had not used the open rule so I can immediately put a rule in front of it to block any ports that haven't traversed it. I'll just close out my question and do things the slow way with exports to Excel. Thanks, Kimsey ... View more

One additional remark about time manipulation - don't render it to a string unless you are absolutely sure you won't be doing anything else with it. And even better - don't render the _value_ to a string - leave the value in an epoch timestamp but use fieldformat command to only display it rendered to a string. ... View more

[script://./bin/starter_script.sh periodic] interval = 0 9 * * * # this will run the script daily @ 9 [script://./bin/starter_script.sh on-start] interval = -1 # this will execute the script on startup The above (or at least a variation of it) worked for me.  The TA in question was only distributed to Linux hosts so I don't know if the same trick will work on windows hosts.  And I'm not sure if the label gets treated as an argument because, in my case, my script didn't attempt to read in any command line arguments. The label at the end of each of the stanzas is not significant - they just need to be different so that the stanza merging logic treats them as two separate stanzas.  And if you have two scripts that you wish to run both on start up and periodically then you can reuse the same label. [script//./bin/script1.sh on-start] interval = -1 [script://./bin/script1.sh midnight] interval = 0 0 * * *  [script//./bin/script2.sh on-start] interval = -1 [script://./bin/script2.sh midnight] interval = 0 0 * * *    ... View more

Fixed in version 1.0.1 ... View more

We are working on a release for Cloud. Stay tuned, thanks! ... View more

MySQL v3.0.0 is released. ... View more

Hi @doksu, I have now seen the ECE and CWR flags "in the wild" so I've locally updated the REGEX for [netfilter_flags] to now be: REGEX = \s((?:(ACK|CWR|ECE|FIN|NS|PSH|RST|SYN|URG)\s)+) ... View more

I have the same problem too, any solution for that? ... View more

Easiest way to check how it is configured on your environment is asking from your ad admins and/or just test it. I think that it depends how it is configured. r. Ismo ... View more

I stumbled across the same thing today. Additionally i was wondering, if the regex itself has a mistake aswell. Our Firepower generates logs with the fields SrcIP and DestIP. However, the regexes only match a lowercase "p" at the end. Original Regex:   EXTRACT-extract_src==^.+SrcIp\:\ (?P<src_ip>[^,;]+) EXTRACT-extract_dest = =^.+DestIp\:\ (?P<dest_ip>[^,]+)   Fixed Regex (not tested):   EXTRACT-extract_src=^.+SrcIP\:\ (?P<src_ip>[^,;]+) EXTRACT-extract_dest = ^.+DestIP\:\ (?P<dest_ip>[^,]+)   ... View more

I am having my indexers throw this same error when I do a search on the search head cluster. It was working fine with 3.2.1 props/lookups but since going to 4.0.2 I am getting this exact same message on all my indexers for any searches. I have made sure the TA exists on both IDX tier and SHC tier. ... View more

ECDHE ciphers support has been added to Splunk version 7.2.11 / 7.3.5 / 8.0.1 onward. ... View more

Thank you. I ended up going in to Settings > Lookups > Lookup table files and found the two CSVs (bitcoin_transactions.csv and firewall_traffic.csv) within the Splunk_ML_Toolkit app. I then changed their Share status from "App" to "Global". The other issue was that I had installed version 5.1.0 of the MLTK on a system running Splunk Enterprise 7.3.4 and it turns out that they're not compatible (MLTK 5+ requires Splunk 😎 - so I had to downgrade MLTK to 4.5.0 and the Python for Scientific Computing app from 2.0.0 down to 1.4. But the visualization's description on SplunkBase says that it requires version 2.0 of the Python for Scientific Computing app so it looks like the visualization is only compatible with Splunk 8+ even though the page says that it's compatible with "8.0, 7.3, 7.2, 7.1, 7.0". I think that I'll just have to park the visualization until we upgrade to 8. ... View more