Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ekzp
ekzp
Explorer
Member since:
11-28-2018
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-28-2018 |
Activity Feed
- Got Karma for Re: How can I log in to update an expired Splunk license?. 06-05-2020 12:50 AM
- Posted Re: How can I tell whether TA-dmarc has pulled any content from an IMAP mailbox, and how can I search for it? on All Apps and Add-ons. 03-04-2019 06:21 AM
- Posted Re: How can I tell whether TA-dmarc has pulled any content from an IMAP mailbox, and how can I search for it? on All Apps and Add-ons. 03-04-2019 05:34 AM
- Posted Re: How can I tell whether TA-dmarc has pulled any content from an IMAP mailbox, and how can I search for it? on All Apps and Add-ons. 02-24-2019 10:54 PM
- Posted Re: How can I tell whether TA-dmarc has pulled any content from an IMAP mailbox, and how can I search for it? on All Apps and Add-ons. 01-28-2019 09:36 PM
- Posted Re: How can I tell whether TA-dmarc has pulled any content from an IMAP mailbox, and how can I search for it? on All Apps and Add-ons. 01-24-2019 11:24 PM
- Posted How can I tell whether TA-dmarc has pulled any content from an IMAP mailbox, and how can I search for it? on All Apps and Add-ons. 01-24-2019 12:40 PM
- Tagged How can I tell whether TA-dmarc has pulled any content from an IMAP mailbox, and how can I search for it? on All Apps and Add-ons. 01-24-2019 12:40 PM
- Posted Re: Can I specify a subfolder of INBOX to poll? on All Apps and Add-ons. 01-24-2019 12:16 PM
- Posted Can I specify a subfolder of INBOX to poll? on All Apps and Add-ons. 01-22-2019 06:29 AM
- Tagged Can I specify a subfolder of INBOX to poll? on All Apps and Add-ons. 01-22-2019 06:29 AM
- Posted Re: How can I log in to update an expired Splunk license? on Installation. 01-18-2019 01:47 AM
- Posted How can I log in to update an expired Splunk license? on Installation. 01-18-2019 12:57 AM
- Tagged How can I log in to update an expired Splunk license? on Installation. 01-18-2019 12:57 AM
- Tagged How can I log in to update an expired Splunk license? on Installation. 01-18-2019 12:57 AM
- Tagged How can I log in to update an expired Splunk license? on Installation. 01-18-2019 12:57 AM
- Posted Re: After installing the Splunk App for Okta on my Splunk Windows installation, why am I getting error "MissingSectionHeaderError: File contains no section headers."? on All Apps and Add-ons. 11-28-2018 09:30 PM
- Posted Re: After installing the Splunk App for Okta on my Splunk Windows installation, why am I getting error "MissingSectionHeaderError: File contains no section headers."? on All Apps and Add-ons. 11-28-2018 09:29 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-04-2019
06:21 AM
Update: seems to be working. The following query returned SPF and DKIM failures:
index=main (feedback{}.record.row.policy_evaluated.spf=fail OR feedback{}.record.row.policy_evaluated.dkim=fail)
Thanks for all the help,
Zoltan
... View more
03-04-2019
05:34 AM
Hi Jorrit,
I can see everything up to "get_dmarc_message_bodies" including.
However I cannot see messages like "save_reports_from_message_bodies", "check_eligible_mimtype" and "write_part_to_file".
Does it mean that processing is incomplete?
Also, what search query can I use to pull some data?
Thanks.
... View more
02-24-2019
10:54 PM
Thanks, I'll give it a try.
... View more
01-28-2019
09:36 PM
The question still remains as aholzel's version errors out on installation.
How can I retrieve some reports with Jorrit Folmer's versio nof TA-dmarc?
Thanks.
... View more
01-24-2019
11:24 PM
There seem to be two different add-ons by two developers, named identically: https://github.com/aholzel/TA-dmarc and https://github.com/jorritfolmer/TA-dmarc. It looks like I tried to combine SA-dmarc with the wrong TA-dmarc.
... View more
01-24-2019
12:40 PM
Hi, installed TA-dmarc and it seems to be successfully accessing the mailbox and the Inbox/DMARC folder. It shows the number of messages found in the folder. But that's where it stops.
I am trying to determine whether it has actually pulled anything from the mailbox, and if so, how can I search for it.
Tried a number of searches. The best I could come up with is
index=* OR index=_* sourcetype=*dmarc*
Also tried
index=dmarc (sourcetype=dmarc OR sourcetype=dmarc:json)
and
index=* OR index=_* (sourcetype=dmarc OR sourcetype=dmarc:json)
inspired from https://github.com/aholzel/SA-dmarc as I intend to use SA-dmarc for dashboarding what TA-dmarc pulls down. None of these searches returned any results.
I even tried setting logging to debug, and I checked the content of %SPLUNKHOME%\log\splunk\ta_dmarc_splunc_imap.log - nothing useful.
So I have these two questions:
1. How can I tell whether TA-dmarc is actually pulling anything from the IMAP folder?
2. What search can I use that returns some results that I can plug into SA-dmarc for dashboarding? Effectively what I am asking is what search string needs to be entered as dmarc_log in the SA-dmark add-on's macros.conf file?
Thanks.
... View more
01-24-2019
12:16 PM
Thanks jorritf. What I found is that TA-dmarc fails to access the folder when using the dot (".") as separator. Using the slash instead ("/") doesn't generate an error.
I am still struggling to get some reports, but at lease this one is out of the way.
... View more
01-22-2019
06:29 AM
Hi, we have a dedicated mailbox to be polled by Splunk.. Currently we have IMAPmailbox, and now we want to add TA-dmarc.
IMAPmailbox is configured to poll INBOX and delete processed items. By the time TA-dmarc will get a chance to do its bit, there will be nothing to process.
For this reason I want to create a subfolder and set up a rule that all DMARC e-mails to be moved to that folder,. This way DMARC emails will not be deleted by IMAPmailbox. Then I want to configure TA-dmarc to poll that subfolder.
Problem: how do I specify a subfolder to poll in the TA_dmarc configuration?
Thanks.
... View more
01-18-2019
01:47 AM
1 Karma
Found the answer at https://answers.splunk.com/answers/51245/heavy-forwarder-change-trial-license-to-forwarder-license-cli-how-to.html.
Swapped to Free license and I am logged on to the web GUI again.
Thanks dkeck, you saved the day. Tried to award points but the portal didn't let me to - sorry...
... View more
01-18-2019
12:57 AM
Hi, I have a Splunk installation running on a Windows 2016 Server.
it looks like the 60-day trial license expired. The advice is to log in as an administrator to update the license. I'd happily do it, but I can't log in anymore. I am getting the following error: "Login failed. Your license is expired. Please login as an administrator to update the license." — I am using the one and only "admin" account. The password hasn't changed.
I tried to move the passwd file and use admin/changeme as suggested in many posts, however I am getting the same result.
I also noticed that the Splunk Web service has stopped. I'm wondering whether it is related to the expired license. I attempted to start it manually, but it stopped again within 20 seconds, saying that the service didn't respond for 300,000 milliseconds. It bailed out just after some 20 seconds — how on earth can it say that when it didn't respond for 300,000 milliseconds????
My problem is that the licenses expiration triggered some weird and unexpected behaviour, I am locked out, I have no way to update the license, and I can find no working answer.
It looks like a chicken-and-egg problem: I need to log on to fix it, which I can't because Splunk locked me out because the license expired.
How can I log in again to update the license?
Thank you.
... View more
Labels
- Labels:
-
license
11-28-2018
09:30 PM
In my case of IMAP Mailbox, MissingSectionHeaderConfig was caused by the encoding of the config file - it was encoded with UTF-8. Opened it with Notepad and saved it as ANSI.
Cheers,
Zoltan
... View more
11-28-2018
09:29 PM
In my case of IMAP Mailbox, MissingSectionHeaderConfig was caused by the encoding of the config file - it was encoded with UTF-8. Opened it with Notepad and saved it as ANSI.
Cheers,
Zoltan
... View more
