Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ssanplunk
ssanplunk
Path Finder
Member since:
10-23-2018
2 weeks ago
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 7 |
| Karma Received | 3 |
| Member Since | 10-23-2018 |
Activity Feed
- Posted Re: Any idea what is causing high memory usage in indexers? on Monitoring Splunk. 2 weeks ago
- Tagged Re: Any idea what is causing high memory usage in indexers? on Monitoring Splunk. 2 weeks ago
- Tagged Re: Any idea what is causing high memory usage in indexers? on Monitoring Splunk. 2 weeks ago
- Tagged Re: Any idea what is causing high memory usage in indexers? on Monitoring Splunk. 2 weeks ago
- Posted Re: Support proxy option in webtools add-on on All Apps and Add-ons. a month ago
- Karma Re: Support proxy option in webtools add-on for jkat54. a month ago
- Posted Re: Any idea what is causing high memory usage in indexers? on Monitoring Splunk. a month ago
- Karma Re: Support proxy option in webtools add-on for livehybrid. a month ago
- Posted Support proxy option in webtools add-on on All Apps and Add-ons. 03-17-2025 06:55 PM
- Karma Re: How to apply curl to each search result without map command ? for jkat54. 03-17-2025 06:32 PM
- Karma Re: What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services? for mayurr98. 04-03-2024 07:35 PM
- Posted Error occurred when collecting OAuth Token Log via Google Workspace for Splunk on Getting Data In. 04-03-2024 01:40 AM
- Got Karma for Re: Connecting Notion Logs to Splunk. 04-03-2024 01:23 AM
- Posted Re: Connecting Notion Logs to Splunk on Splunk Enterprise. 04-03-2024 01:12 AM
- Posted Re: Not able to open Splunk folder available in C:/Program files on Splunk Enterprise. 05-29-2023 10:05 PM
- Karma Re: Does Splunk_TA_webtools (v1.3) provide a timeout option when using curl?, for jkat54. 06-05-2020 12:50 AM
- Got Karma for How to apply curl to each search result without map command ?. 06-05-2020 12:50 AM
- Got Karma for Re: How to exclude the MicrosoftTeams Workload log?. 06-05-2020 12:50 AM
- Posted Re: How to apply curl to each search result without map command ? on All Apps and Add-ons. 02-27-2019 09:00 PM
- Posted Re: How to apply curl to each search result without map command ? on All Apps and Add-ons. 01-31-2019 05:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
Hi. If your splunk version is 9.1 or higher, please refer to the case below. You can solve it by setting the option below in server.conf to false. > https://splunk.my.site.com/customer/s/article/PreforkedSearchProcessException-can-t-launch-new-search-process-because-pool-is-full However, since the default setting is true, it is recommended to contact splunk support and decide. [general] enable_search_process_long_lifespan = false
... View more
a month ago
Thanks for your support! I'll test it using the full request code and share it with you.
... View more
a month ago
Did you solve this problem? I had the same symptoms and was wondering how you solved it.
... View more
03-17-2025
06:55 PM
Hi. I checked the issue below, but I couldn't find proxy option in the code. https://github.com/bentleymi/ta-webtools/issues/17 Is the proxy option (-x or --proxy) of linux curl available on the WebTools Add-on? If there is another way that I don't know, please share it. @jkat54 Webtools Add-on
... View more
Webtools Add-on
Webtools Add-on
Labels
- Labels:
-
search
04-03-2024
01:40 AM
Hello! When I set up to collect Google Workspace's OAuth Token Event log using Google Workspace for Splunk, the following error occurs. The Credential is valid, so other logs (drive, login, etc.) are being collected well. I would like to know the cause and solution. error_message="'str' object has no attribute 'get'" error_type="<class 'AttributeError'>" error_arguments="'str' object has no attribute 'get'" error_filename="google_client.py" error_line_number="1242" input_guid="{input-guid-number}" input_name="token" e.g.) google workspace OAuth Token Log https://developers.google.com/admin-sdk/reports/v1/appendix/activity/token?hl=en
... View more
Labels
- Labels:
-
heavy forwarder
04-03-2024
01:12 AM
1 Karma
Hello, Notion does not support On-premise OR Splunk Cloud Trial. Only Support Splunk Cloud Enterprise. If you use Splunk Cloud Enterprise, you need to enter the URL in the format below. https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/UsetheHTTPEventCollector Send data to HTTP Event Collector on Splunk Cloud Platform
You must send data using a specific URI for HEC.
The standard form for the HEC URI in Splunk Cloud Platform free trials is as follows:
<protocol>://http-inputs-<host>.splunkcloud.com:<port>/<endpoint>
The standard form for the HEC URI in Splunk Cloud Platform is as follows:
<protocol>://http-inputs-<host>.splunkcloud.com:<port>/<endpoint>
The standard form for the HEC URI in Splunk Cloud Platform on Google Cloud is as follows:
<protocol>://http-inputs.<host>.splunkcloud.com:<port>/<endpoint>
The standard form for the HEC URI in Splunk Cloud Fedramp Moderate on AWS Govcloud is as follows:
<protocol>://http-inputs.<host>.splunkcloudgc.com:<port>/<endpoint>
... View more
05-29-2023
10:05 PM
If you change authorization of splunk folder, you can access splunk folder on Windows. You can follow the step below. 1. Right click - splunk folder 2. Click - property menu 3. Move - Security Tab 4. Click - Edit 5. Click - Add 6. Search and Add - Users Group 7. Confirm
... View more
02-27-2019
09:00 PM
Hi jkat54,
I completed test at web tools ver1.2.3.
It works good!
Thanks!
... View more
01-31-2019
05:42 PM
Hi
Thank you for your help!
I will update app and try the SPL.
... View more
01-31-2019
05:41 PM
Hi,
Thank you for your help.
I checked more information in doc!
... View more
01-29-2019
10:11 PM
Hi, all
I am currently collecting the ThreatIntelligence Workload using the Splunk Add-on for Microsoft Cloud Services.
While reviewing the collected logs, I saw a log that the UserId field is "notracking@example.com", but I do not know what it means.
I want to make sure that "notracking@example.com" is provided by Office 365, or information generated by add-on.
The RecordType for that log is 41.
Office 365 Management Schema documents do not provide this information.
{ [-]
AppName: Mail
AppVersion: 0.0.0000
CreationTime: 2019-01-28T22:37:20
Id: #blind#
OS: Win32
Operation: TIUrlClickData
OrganizationId: #blind#
RecordType: 41
SourceId: #blind#
SourceWorkload: Mailflow
TimeOfClick: 2019-01-28T22:34:40
Url: http://abcde.com/?61o1EX=IGCQlSQRYNiGBrD0ALmQHT3LUw
UrlClickAction: 2
UserId: notracking@example.com
UserIp: 10.10.10.10
UserKey: ThreatIntel
UserType: 4
Version: 1
Workload: ThreatIntelligence
}
Thank you.
... View more
01-27-2019
07:09 PM
1 Karma
Hi,
I am using curl command in Web Tools Add-on.
How to use "curl" query to make result of below without map command ?
index=test
=> result field is "NUM"
1
2
3
|curl http://1.1.1.1/q?q=1
|curl http://1.1.1.1/q?q=2
|curl http://1.1.1.1/q?q=3
I used macro as below for this case, but it didn't apply.
macro(1): curl http://1.1.1.1/q?q=$NUM$
query: index=test | `macro(NUM)`
result is below:
|curl http://1.1.1.1/q?q=NUM
|curl http://1.1.1.1/q?q=NUM
|curl http://1.1.1.1/q?q=NUM
... View more
01-27-2019
07:03 PM
This question is an additional question for the answer above.
Okay I will try new question.
... View more
01-24-2019
08:41 PM
How to use query to make result of below without map command ?
index=test
=> result field is "NUM"
1
2
3
|curl http://1.1.1.1/q?q=1
|curl http://1.1.1.1/q?q=2
|curl http://1.1.1.1/q?q=3
I used macro as below for this case, but it didn't apply.
macro(1): curl http://1.1.1.1/q?q=$NUM$
query: index=test | `macro(NUM)`
result
|curl http://1.1.1.1/q?q=NUM
|curl http://1.1.1.1/q?q=NUM
|curl http://1.1.1.1/q?q=NUM
... View more
01-24-2019
08:24 PM
I checked streaming about curl command.
Thank you for reply.
If you update about the proxy option, I will update too. Thanks!
... View more
01-23-2019
09:45 PM
Thank you! I will update the lastest version!
... View more
01-23-2019
09:42 PM
Hi,
I appreciate the answers to the links below.
https://answers.splunk.com/answers/693317/does-splunk-ta-webtools-v13-provide-a-timeout-opti.html
Here are some additional questions about the Web Tools Add-on:
1. Is it possible to apply the curl command for each search result (url link)?
2. Is the proxy option (-x or --proxy) of linux curl available on the Web Tools Add-on?
I need to use the curl command for each search result, and at the same time I need access via a specific proxy.
Thank you!
... View more
01-20-2019
05:42 PM
1 Karma
I used "TRANSFORMS-filter" to exclude a particular workload log.
props.conf
# add TRANSFORMS-filter
[ms:o365:management]
TRANSFORMS-filter = o365null
transforms.conf
# if it match the regex, go to nullQueue
[o365null]
REGEX = (MicrosoftTeams)
DEST_KEY = queue
FORMAT = nullQueue
Thanks!
... View more
12-12-2018
08:40 PM
Thank you for your reply.
... View more
12-12-2018
08:17 PM
Hi all,
I am using Splunk Add-on for Microsoft Cloud Services.
The collected Workload types are as follows.
- AzureActiveDirectory
- MicrosoftTeams
- Exchange
Of the above Workloads, the microsoftteams log is not needed and I do not want to index the splunk.
Is there a way to exclude the log whose workload is MicrosoftTeams when it proceeds to index?
... View more
10-23-2018
03:16 AM
Hi,
I'm using Splunk_TA_webtools 1.3.
Does Splunk_TA_webtools 1.3 support the timeout parameter when using curl?
Is support for Splunk_TA_webtools terminated?
Thanks.
... View more
- Tags:
- Webtools Add-on
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
