Hi @Abirami_09 , you can select the version in the left side of the page. https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license  ... View more

Just for the sake of clarity (and that's probably one of the reason there is so much confusion about this). It's not that you "drop" or "pull" the events. If you dropped the events you wouldn't have anything to pull back. Transforms just set metadata field which is used _after_ to route events. So you can manipulate this metadata at will and switch it back and forth. After you leave the transforms phase the data is getting routed or dropped according to the final state of the metadata fields. ... View more

Please don't share "ready to use" scripts based on serious assumptions without at least explaining what those assumptions are. In here your quite strong assumption is that there would be no files matching firewall-*.log.gz coming from other sources (possibly in other subdirectories. Also - you're mixing -name with -iname. ... View more

@egko  Your Splunk Enterprise 8.1x is outdated, and Splunk Enterprise Security 7.0.1 is likely incompatible, causing the KV Store to fail (from "Ready" to "Failed") when ES loads. Upgrade Splunk Enterprise, then upgrade ES to a compatible version. #https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.0/upgrade-or-migrate-splunk-enterprise/how-to-upgrade-splunk-enterprise Regards, Prewin 🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

Hi @DashZentin  If you are seeing 'FROM_THE_FUTURE' then it means the license isnt valid yet. Do you know what the startdate of the license is? If you edit the license file in a text editor is the creation_time value in the future? (Greater than the current timestamp - 1764629805) ? If so you will need to speak to Splunk about ensuring your license is valid and current not future dated! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

I tried loggout and logging back in, but didnt work. The size of the lookup is 190 KB ... View more

Yes. It went to spam somehow. Thanks for the reply. ... View more

Thank you, Thahir Updated permissions to the role accessing the S3 bucket and that fixed the issue.   ... View more

@yassenfouadanis  It looks like this is a permissions issue. Because ECS Managed Instances don’t allow you to run commands directly on the host, you’ll need to fix it in the task definition instead. Please go to the ECS console, create a new revision of the task definition with your parameters, and add "user": "0" to the container definition (before the environment variables section). This will run the Splunk container as the root user so it can write to the EBS volume. Once everything is working, we can adjust the user configuration if needed. ... View more

@aneumeyer This add on directly pull the logs from the workday tenant and retrieving user activity through workday API's. This addon automatically parse the some of important logs streams and its readily available while searching the workday data in the Splunk.   ... View more

An update on this issue:  I am now getting this error in Splunk. Any idea what could be the issue here? Firewall rules have been checked and all, no messages from graph are being dropped.   ... View more

What would be the additional certificates in that case if I can add to avoid the issue? And where usually we can add those before starting installation? ... View more

OK. Now we're getting somewhere 😉 Poet 9997 is for data forwarding. Forwarders register in Deployment Server on 8089. Also you need to configure the client to use a DS - with Windows UF, if you installed it interactively, you had a dialog during installation letting you specify the DS address. If you pointed it to your Splunk Server, enabled the DS functionality on your Splunk server and opened the 8089 port, the forwarder should register itself with the DS. So that's the reason why you're not seeing your UF as deployment client. If you provided target indexer address during UF installation, you should be (if everything works OK) seeing forwarders internal log in the _internal index. ... View more

Here is Splunk's instructions for use DS currently named Client management or something similar https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.4/deployment-server-and-forwarder-management/about-deployment-server-and-forwarder-management It needs that you have some apps defined for deploy to your clients. The easiest way to do it is just create e.g. Splunk App for collecting some WindowEvents from UF. Then install it in your server under /opt/splunk/etc/deployment-apps and restart your splunk instance. After that there should be Forwarder management in your Settings menu.   ... View more

Additional to other instructions, here is Splunk's best practice documentation for upgrade https://lantern.splunk.com/Manage_Performance_and_Health/Upgrading_the_Splunk_platform ... View more

Hi @fzel  You can certainly deploy Splunk on K8s using "Splunk Operator for Kubernetes" as per the link that @thahir provided, which is a valid and supported Splunk Validated Architecture (SVA), with the biggest limitation being if you intend to run ITSI on it then this is not currently supported. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hello, +++++++++++++ Indexer Cluster + +++++++++++++ Via GUI ======== cluster-manager -------------- Settings -> Indexer Clustering -> Enable indexer clustering -> Manager node -> Replication Factor : 2 Search Factor : 2 Security Key :passkey123 Cluster Label : Cluster1 Click -> Enable Manger Node Peer Node ---------- Settings -> Indexer Clustering -> Enable indexer clustering -> Peer node Manager URI : https://managerip:8089 [Cluster manager] Peer replication port : 8080 Security key : passkey123 Click -> Enable Peer Node Search head node ---------------- Settings -> Indexer Clustering -> Enable indexer clustering -> Search head node Manager URI : https://managerip:8089 Security key : passkey123 Click -> Enable Search head Node Via Config File: ======== Manager: -------- server.conf [clustering] mode = manager replication_factor = 2 search_factor = 2 pass4SymmKey = passkey123 cluster_label = cluster1 Peer Node: ---------- server.conf [replication_port://8080] [clustering] manager_uri = https://managerip:8089 mode = peer pass4SymmKey = passkey123 Search Head: ------------ [clustering] manager_uri = https://managerip:8089 mode = searchhead pass4SymmKey = passkey123 Via Cli ======= Manager Node: -------------- ./splunk edit cluster-config -mode manager -replication_factor 2 -search_factor 2 -secret passkey123 -cluster_label cluster1 ./splunk restart Peer Node: ---------- ./splunk edit cluster-config -mode peer -manager_uri https://managerip:8089 -replication_port 8080 -secret passkey123 ./splunk restart Search Head: ------------ ./splunk edit cluster-config -mode searchhead -manager_uri https://managerip:8089 -secret passkey123 ./splunk restart ./splunk show cluster-status +++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++ Searh Head Cluster ++++++++++++++++++ Deployer ------------ server.conf [shclustering] pass4SymmKey = yoursecuritykey shcluster_label = shcluster1 SH --- /opt/splunk/bin/splunk init shcluster-config -auth admin:changed -mgmt_uri https://sh1.example.com:8089 -replication_port 8887 -replication_factor 2 -conf_deploy_fetch_url https://deployerip:8089 -secret yoursecuritykey -shcluster_label shcluster1 [Repeat On all SH only by changing mgmt_uri] Once done in All SH. Choose captain. /opt/splunk/bin/splunk bootstrap shcluster-captain -servers_list "https://sh1.example.com:8089,https://sh2.example.com:8089,https://sh3.example.com:8089,https://sh4.example.com:8089" -auth admin:changed Check Status /opt/splunk/bin/splunk show shcluster-status Thank You! ... View more

Hi @HasterHerman  My suggestion is try to use the Generic S3 input in the Splunk Add-on for AWS, you can ingest logs collected from multiple AWS accounts sent to a central S3 bucket. The S3 bucket typically contains logs from different accounts and different CloudWatch log groups, organized via the S3 key/prefix convention (such as AWSLogs/<AccountID>/<log-group-name>/...). This allows you to pull and distinguish logs from various groups and accounts.   ... View more

Yes, but I'm not sure if it will work with EVT files (not EVTX!) ... View more

@lwray21 You cannot currently enforce TLS 1.3 for Splunk HEC traffic; Splunk only supports up to TLS 1.2 for inbound HEC connections, so an ALB with TLS 1.3-only policy will not work. ... View more

Here is documentation what happening when you have license violations and when those are real violations and when those are more or less informative messages. https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.3/manage-splunk-licenses/about-license-violations#ariaid-title4 e.g. with Splunk Free there is this limitation: If you generate three or more warnings in a rolling 30-day period, you are in violation of your license. Splunk Enterprise continues to index your data, but you cannot search it. The warnings persist for 14 days. No reset license is available. So after three warnings within 14 calendar days your searches have blocked until there is max two warning in 14 days. But e.g. with Enterprise with more than 100GB/d license you can still search even you have more than 45 breaches within rolling 60 day period. Of course you must contact to Splunk and agree for additional license quota. ... View more

Hi @AliMaher ,   Yes, it's possible to use the Splunk SOAR as a standalone and you can do with integrations other SIEM solutions, there are prebuilds apps are available in the Splunk soar for the integration with other SIEM's. ... View more

@EMDEEEEE   If you haven’t integrated Splunk users with LDAP or SAML, then user management activities (like account edits, password resets, or role changes) are logged in the _audit index. You can search with something like below SPL in the SH. index=_audit action=edit_user However, if your Splunk environment is integrated with Active Directory/Windows authentication, account lifecycle events (disable/enable, password resets, etc.) won’t appear in _audit. Instead, you’ll need to rely on Windows Security Event Logs indexes — for example: 4722 → User account enabled 4725 → User account disabled 4723/4724 → Password change/reset ... View more

You can find Splunk's internal error and system logs in the following default locations, depending on your OS: 1. Main log file – splunkd.log This is the primary log for internal errors, warnings, and events. Default paths: Linux: /opt/splunk/var/log/splunk/splunkd.log Windows: C:\Program Files\Splunk\var\log\splunk\splunkd.log You can also search this log in Splunk using: index=_internal sourcetype=splunkd 2. Other useful log files (same directory): web_service.log – Web interface issues scheduler.log – Scheduled searches and jobs metrics.log – Performance metrics python.log – Scripted inputs and Python errors audit.log – User actions and security events If this helped you, some karma would be appreciated! ... View more