Check if the user belongs to groups which have permissions to access Splunk. ... View more

I just ran into this issue and what I did was as superuser, made the '/root/.splunk' directory and changed the owner to splunk ... View more

It is happening for all events, at least some of those events have drilldown searches and names configured. I tried updating the drilldown search name just to see if it would change anything - unfortunately it did not. I appreciate your input. ... View more

I would recommend submitting that via a support ticket against ES. ... View more

We (thanks to professional services) were able to get the app working for ticket generation by following the steps listed here: http://docs.splunk.com/Documentation/AddOns/released/Remedy/Setup NOTE: For some reason that page is not directly connected to the remedy documentation We did have to modify the “create_operation_name.” The correct value was found by CURLing the custom WSDL url and taking the element name from the stanza where the InputMapping/fields are defined. Following these steps we were able to see data in the staging form but we were still riddled with errors (mostly because the TA tries to confirm a ticket exists). REALLY - This app does not support staging forms. If you are looking for that functionality you should submit a feature request. ... View more

A sort _time in search seems to mitigate the error for us, however, this does not fix the underlying issue. ... View more

jhall0007- Thanks for mentioning this. This is a known problem and will be addressed. While placing the lookups in a new app works, the problem is that the app blacklists the sample lookups in distsearch.conf. However, it's overzealous and blacklists ALL the lookups. 🙂 Out of the box: excludeSSE1 = ...Splunk_Security_Essentials_for_Ransomware/lookups... excludeSSE2 = ...Splunk_Security_Essentials_for_Ransomware\lookups... Fix: excludeSSE1 = ...Splunk_Security_Essentials_for_Ransomware/lookups/UC... excludeSSE2 = ...Splunk_Security_Essentials_for_Ransomware\lookups\UC.. ... View more

The RESTful dashboard (Matrix Overview) is immediate, and current, instead of the "snapshot" data derived from dbinspect. The latter is fairly disk-intensive at search time, so I opted to cache it by running once a day. Your points are perfectly valid, but it's a design decision (based in efficiency) that's now pretty well entrenched. I'm looking at ways to make the app more responsive (like being ready to go "day one" rather than waiting until midnight), and your feedback is helpful in knowing how people are using it. Thanks for using it, and for your comments. Glad to hear it's working for you now. ... View more

Hm; when did that happen? I could have sworn that it used to be top-to-bottom serially but the dox are clear. I will update my answer according to: https://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/definecalcfields ... View more

The "WSDL: HPD_IncidentInterface_Create_WS" is statically assigned by the python setup script. I found a second (hidden?) setup page which walks through setting the app up if you have a custom remedy staging form. Basically you have to manually setup your remedy.conf file instead of letting the setup script do it: http://docs.splunk.com/Documentation/AddOns/released/Remedy/Setup I personally have not been able to get this working. I'd love to hear if you've had better luck. ... View more

sounds like you were using bluecoat:proxysg:access:file sourcetype to leverage INDEXED_EXTRACTIONS. is that correct? if so, you can try to use sourcetype bluecoat:proxysg:access:syslog with the recommended log format configured (default bcereportermain_v1) on the bluecoat side: http://docs.splunk.com/Documentation/AddOns/latest/BlueCoatProxySG/Sourcetypes ... View more