Hello, I just installed the ML toolkit for Splunk and am running into the below error every time I go to the showcase and attempt to use one of the dashboards and create a "fit model". Error in 'fit' command: External search command exited unexpectedly. I've also tested the SPL search using the fit command and I get the same error. I've made sure to download Python for Scientific Computing Add-on specific to my OS (linux) prior to installing the ML toolkit and made sure that the permissions are all global. Splunkd.log is only show the below error message: 07-26-2019 14:39:01.121 -0400 ERROR ChunkedExternProcessor - EOF while attempting to read transport header 07-26-2019 14:39:01.121 -0400 ERROR ChunkedExternProcessor - Error in 'fit' command: External search command exited unexpectedly. Splunk version: 7.0.2 Has anyone run into this issue before with this app, or maybe a different app with the same error? The fit command is essentially a python script and I've been combing through the code, but can't determine which line the EOF error is referencing. ... View more

Hello, I am in the process of setting up integration with Tanium and I noticed that the payload is always base64 encoded. Is there a way either through Tanium or through Splunk to decode this field on the fly? If I have to parse this through Splunk I would need to extract the fields that are associated with the encoded string. Also, can this be done at index time or before hand if done by Splunk, maybe through a HF? Hoping someone has some experience with Tanium configurations specifically. Thanks ... View more

Hello, I just have a question regarding subsearches and the time range picker. I am trying to run a subsearch that will look back one month to find account numbers to compare against, however I am getting mixed results. My problem is that the current/main search runs with a time range of last 15 minutes, and my subsearch contains the below to look back one month (just an example, I know data is available to test 1 day back), but I am getting no results back: index=test [search index=test earliest=-1mon latest=@d | table account | format account] The only time I get results back is if I increase the main searches time range. I feel like I might be missing something here, but the documentation does say you can set inline time modifiers in both main searches and subsearches, but does not mention if the time range picker needs to be a value greater or equal too the inline modifier. My goal: Perform a look back on all of the accounts created last month up until the start of the current day (midnight), and if the account shows in my main search, do not fire an alert. I need this look back in order to perform this comparison, if any other suggestions are recommended please advise. ... View more

Hello, I'm trying to setup a filter to drop specific events that contain an event name from AWS. I've read through the splunk docs and the process seems straight forward: On the HF where I am getting my input for AWS logs I've made the updates to the props.conf and transforms.conf file like so: props.conf [aws] TRANSFORMS-set_null = to_null transforms.conf [to_null] REGEX = eventname DEST_KEY = queue FORMAT = nullQueue I did not list my regex in this example as I don't feel this is the issue (I've verified the expression works outside of splunk against the raw events). Is there something else I am missing here? As a pre-caution ive also added the above files to my indexers, but am still seeing the events in question. ... View more