About woodcock

Kfesliyan

Did the Graph API do the trick for Defender ATP logs? I have the exact same question for the setup...

swebb07g

Did you ever get this working?

Subham

I tried using this code (put the .CSS file in apps/appserver/static) but was unable to change color for the values in header for my table.. I have some static headers values and need to change the color for them.. Can anyone help please?

tariq_mohammad

Thanks, It helps me , I did rolling restart through cluster master GU Interface.

rita201

Am having similar issue, please did you ever get any solution on this issue? Another concern is that i upgraded Splunk to 8.1.1 and db connect to 3.4.2. I have a data connection that is point to MS generic driver. please can i have a url that i will get that drive from as well?

SamHTexas

Mr. Woodcock, I have 2 MC in distributed mode - only 1 showing peers. 2 MC in standalone mode no peers defined. It is something I inherited. Does this look like over doing it? Too much resources used for same reasons? Please advise.

Jarohnimo

Hi @woodcock do the scripts you place in the opt/splunk/bin/scripts Directory remain persistent after an upgrade? Can you point me to documentation that explains? Thanks

SamHTexas

Thank u for your answer reg. SIEM roles. What is the ES role you'd assign a user short of admin / ess_admin who would be able to do investigations & searching ? We have Splunk Enterprise & ES in our environment. Thanks

SamHTexas

Please show me where (which Splunk server) this advanced setting area is located & how to change the TTL. Thank u

apietersen

Update: "sendemail" does not work for default users with default user-role capability. The issue was reported back to me to be solved in 8.1.3, unfortunately it is not.

IG1690

I am trying to do the opposite to this query - how do I get the returned Event to show only lines which match the query - not adjacent lines?

Bakkar

Updated inputs.conf file from path "C:\Program Files\SplunkUniversalForwarder\etc\system\default" [monitor://$SPLUNK_HOME\var\log\splunk] index =<Your Indexname> [monitor://$SPLUNK_HOME\var\log\watchdog\watchdog.log*] index =<Your Indexname> Hope this helps

woodcock

DNS servers.

jaxjohnny2000 · ‎03-11-2021

try this: Better Audit Logs | Ideas (splunk.com)

manikandanp · ‎03-10-2021

I'm also facing the same issue, while using threatconnect app fields tag.name & tag.weblink in lookup command output. Actually, splunk supports dot notation on the normal lookups, i won't face issue on it. But on the threatconnect app, tag field is consist of name & weblink [key-value pairs]. While trying to access tag.name & tag.weblink in lookup command facing issue. Can anyone help on this.

bandit · ‎03-09-2021

Vote for Trellis 1000 on Splunk Ideas! https://ideas.splunk.com/ideas/EID-I-862

wildbird · ‎03-07-2021

Hey We have reached a point where we need to expand the number of servers in our architecture For reasons of proper management, This will require me to move HF from the existing address to another address. currently the HF is part of SHC, I would love an explanation of how the transition can be done smoothly

tscroggins · ‎03-06-2021

Agreed. Hence: " The challenge becomes writing a family of date comparison macros (eq, ne, gt, lt, etc.) that convert an epoch value to a set of reduced terms, perhaps including a time format string parameter." I haven't fiddled with it yet. What did your data model experiments reveal?

rballan2 · ‎03-06-2021

I have the same error in the splunkd.log file. The ssh -v DS-IPaddress whos Connection established. Any other suggestion how to further troubleshooting the issue ?

bandit · ‎03-05-2021

Posted to Splunk ideas https://ideas.splunk.com/ideas/EID-I-859

Posts	12141
Solutions	1745
Karma Given	1936
Karma Received	3329
Member Since	‎10-22-2010

Online Status	Offline
Date Last Visited	Thursday

How to leverage a secondary time field at scale?

Gregg Woodcock & Splunxter introduction

Which app(s) for Microsoft Windows Defender ATP?

How to handle splunkbase apps with "[script::...]:...

How to access "_indextime" to calculate "latency" ...

New "role" cannot be added to any users due to "is...

Make "Show on Timeline" default to "Yes" (checked)...

What is the difference between a "Finalized" searc...

Force/Keep search saved as "Report" to stay on "St...

Run MC Health Checks on scheduled basis and email ...

Re: Which app(s) for Microsoft Windows Defender AT...

Re: How do you extract a timestamp from JSON logs ...

Re: Need to apply header color based on the header...

Re: splunk indexer: status: "pending", fully searc...

Re: Splunk DBConnect 3.1.1 Build 34 There was an e...

Re: How to monitor search head cluster from a moni...

Re: Correct Location for Splunk Input Scripts and ...

Re: What is the purpose of ess_admin role in splun...

Re: Setting for cleaning scheduled saved search ar...

Re: Send a mail using sendemail command from searc...

Re: How do I get more context around my search res...

Re: Setting indexes on windows universal forwarder

Re: Best method for pulling Microsoft DNS logs wit...

Re: How can I determine who modified a dashboard?

Re: Lookup command doesn't support dot notation in...

Re: Is there a way to display more than 20 charts ...

Re: Is it possible to change default indexer IP on...

Re: How to leverage a secondary time field at scal...

Re: How to resolve "err=not_connected" error in De...

Re: FEATURE REQUEST: Splunk Alert: All Clear Notif...