Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ssanplunk
ssanplunk
Path Finder
Member since:
10-23-2018
2 weeks ago
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 4 |
| Karma Received | 3 |
| Member Since | 10-23-2018 |
Activity Feed
- Karma Re: What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services? for mayurr98. 2 weeks ago
- Posted Error occurred when collecting OAuth Token Log via Google Workspace for Splunk on Getting Data In. 2 weeks ago
- Got Karma for Re: Connecting Notion Logs to Splunk. 2 weeks ago
- Posted Re: Connecting Notion Logs to Splunk on Splunk Enterprise. 2 weeks ago
- Posted Re: Not able to open Splunk folder available in C:/Program files on Splunk Enterprise. 05-29-2023 10:05 PM
- Karma Re: How to apply curl to each search result without map command ? for jkat54. 09-23-2021 04:24 AM
- Karma Re: Does Splunk_TA_webtools (v1.3) provide a timeout option when using curl?, for jkat54. 06-05-2020 12:50 AM
- Got Karma for How to apply curl to each search result without map command ?. 06-05-2020 12:50 AM
- Got Karma for Re: How to exclude the MicrosoftTeams Workload log?. 06-05-2020 12:50 AM
- Posted Re: How to apply curl to each search result without map command ? on All Apps and Add-ons. 02-27-2019 09:00 PM
- Posted Re: How to apply curl to each search result without map command ? on All Apps and Add-ons. 01-31-2019 05:42 PM
- Posted Re: What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 01-31-2019 05:41 PM
- Posted What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 01-29-2019 10:11 PM
- Tagged What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 01-29-2019 10:11 PM
- Tagged What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 01-29-2019 10:11 PM
- Tagged What does "notracking@example.com" mean in Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 01-29-2019 10:11 PM
- Posted How to apply curl to each search result without map command ? on All Apps and Add-ons. 01-27-2019 07:09 PM
- Tagged How to apply curl to each search result without map command ? on All Apps and Add-ons. 01-27-2019 07:09 PM
- Tagged How to apply curl to each search result without map command ? on All Apps and Add-ons. 01-27-2019 07:09 PM
- Posted Re: How to apply curl to each search result (proxy option required) on Web Tools Add-on on All Apps and Add-ons. 01-27-2019 07:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
Hello! When I set up to collect Google Workspace's OAuth Token Event log using Google Workspace for Splunk, the following error occurs. The Credential is valid, so other logs (drive, login, etc.) are being collected well. I would like to know the cause and solution. error_message="'str' object has no attribute 'get'" error_type="<class 'AttributeError'>" error_arguments="'str' object has no attribute 'get'" error_filename="google_client.py" error_line_number="1242" input_guid="{input-guid-number}" input_name="token" e.g.) google workspace OAuth Token Log https://developers.google.com/admin-sdk/reports/v1/appendix/activity/token?hl=en
... View more
Labels
- Labels:
-
heavy forwarder
2 weeks ago
1 Karma
Hello, Notion does not support On-premise OR Splunk Cloud Trial. Only Support Splunk Cloud Enterprise. If you use Splunk Cloud Enterprise, you need to enter the URL in the format below. https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/UsetheHTTPEventCollector Send data to HTTP Event Collector on Splunk Cloud Platform
You must send data using a specific URI for HEC.
The standard form for the HEC URI in Splunk Cloud Platform free trials is as follows:
<protocol>://http-inputs-<host>.splunkcloud.com:<port>/<endpoint>
The standard form for the HEC URI in Splunk Cloud Platform is as follows:
<protocol>://http-inputs-<host>.splunkcloud.com:<port>/<endpoint>
The standard form for the HEC URI in Splunk Cloud Platform on Google Cloud is as follows:
<protocol>://http-inputs.<host>.splunkcloud.com:<port>/<endpoint>
The standard form for the HEC URI in Splunk Cloud Fedramp Moderate on AWS Govcloud is as follows:
<protocol>://http-inputs.<host>.splunkcloudgc.com:<port>/<endpoint>
... View more
05-29-2023
10:05 PM
If you change authorization of splunk folder, you can access splunk folder on Windows. You can follow the step below. 1. Right click - splunk folder 2. Click - property menu 3. Move - Security Tab 4. Click - Edit 5. Click - Add 6. Search and Add - Users Group 7. Confirm
... View more
02-27-2019
09:00 PM
Hi jkat54,
I completed test at web tools ver1.2.3.
It works good!
Thanks!
... View more
01-31-2019
05:42 PM
Hi
Thank you for your help!
I will update app and try the SPL.
... View more
01-31-2019
05:41 PM
Hi,
Thank you for your help.
I checked more information in doc!
... View more
01-29-2019
10:11 PM
Hi, all
I am currently collecting the ThreatIntelligence Workload using the Splunk Add-on for Microsoft Cloud Services.
While reviewing the collected logs, I saw a log that the UserId field is "notracking@example.com", but I do not know what it means.
I want to make sure that "notracking@example.com" is provided by Office 365, or information generated by add-on.
The RecordType for that log is 41.
Office 365 Management Schema documents do not provide this information.
{ [-]
AppName: Mail
AppVersion: 0.0.0000
CreationTime: 2019-01-28T22:37:20
Id: #blind#
OS: Win32
Operation: TIUrlClickData
OrganizationId: #blind#
RecordType: 41
SourceId: #blind#
SourceWorkload: Mailflow
TimeOfClick: 2019-01-28T22:34:40
Url: http://abcde.com/?61o1EX=IGCQlSQRYNiGBrD0ALmQHT3LUw
UrlClickAction: 2
UserId: notracking@example.com
UserIp: 10.10.10.10
UserKey: ThreatIntel
UserType: 4
Version: 1
Workload: ThreatIntelligence
}
Thank you.
... View more
01-27-2019
07:09 PM
1 Karma
Hi,
I am using curl command in Web Tools Add-on.
How to use "curl" query to make result of below without map command ?
index=test
=> result field is "NUM"
1
2
3
|curl http://1.1.1.1/q?q=1
|curl http://1.1.1.1/q?q=2
|curl http://1.1.1.1/q?q=3
I used macro as below for this case, but it didn't apply.
macro(1): curl http://1.1.1.1/q?q=$NUM$
query: index=test | `macro(NUM)`
result is below:
|curl http://1.1.1.1/q?q=NUM
|curl http://1.1.1.1/q?q=NUM
|curl http://1.1.1.1/q?q=NUM
... View more
01-27-2019
07:03 PM
This question is an additional question for the answer above.
Okay I will try new question.
... View more
01-24-2019
08:41 PM
How to use query to make result of below without map command ?
index=test
=> result field is "NUM"
1
2
3
|curl http://1.1.1.1/q?q=1
|curl http://1.1.1.1/q?q=2
|curl http://1.1.1.1/q?q=3
I used macro as below for this case, but it didn't apply.
macro(1): curl http://1.1.1.1/q?q=$NUM$
query: index=test | `macro(NUM)`
result
|curl http://1.1.1.1/q?q=NUM
|curl http://1.1.1.1/q?q=NUM
|curl http://1.1.1.1/q?q=NUM
... View more
01-24-2019
08:24 PM
I checked streaming about curl command.
Thank you for reply.
If you update about the proxy option, I will update too. Thanks!
... View more
01-23-2019
09:45 PM
Thank you! I will update the lastest version!
... View more
01-23-2019
09:42 PM
Hi,
I appreciate the answers to the links below.
https://answers.splunk.com/answers/693317/does-splunk-ta-webtools-v13-provide-a-timeout-opti.html
Here are some additional questions about the Web Tools Add-on:
1. Is it possible to apply the curl command for each search result (url link)?
2. Is the proxy option (-x or --proxy) of linux curl available on the Web Tools Add-on?
I need to use the curl command for each search result, and at the same time I need access via a specific proxy.
Thank you!
... View more
01-20-2019
05:42 PM
1 Karma
I used "TRANSFORMS-filter" to exclude a particular workload log.
props.conf
# add TRANSFORMS-filter
[ms:o365:management]
TRANSFORMS-filter = o365null
transforms.conf
# if it match the regex, go to nullQueue
[o365null]
REGEX = (MicrosoftTeams)
DEST_KEY = queue
FORMAT = nullQueue
Thanks!
... View more
12-12-2018
08:40 PM
Thank you for your reply.
... View more
12-12-2018
08:17 PM
Hi all,
I am using Splunk Add-on for Microsoft Cloud Services.
The collected Workload types are as follows.
- AzureActiveDirectory
- MicrosoftTeams
- Exchange
Of the above Workloads, the microsoftteams log is not needed and I do not want to index the splunk.
Is there a way to exclude the log whose workload is MicrosoftTeams when it proceeds to index?
... View more
10-23-2018
03:16 AM
Hi,
I'm using Splunk_TA_webtools 1.3.
Does Splunk_TA_webtools 1.3 support the timeout parameter when using curl?
Is support for Splunk_TA_webtools terminated?
Thanks.
... View more
- Tags:
- Webtools Add-on
