Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About pateriaak
pateriaak
Explorer
Member since:
02-26-2019
07-15-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 02-26-2019 |
Activity Feed
- Karma Re: Microsoft Graph Security API Add-on configuration issue for faizancool85. 07-15-2020 03:15 AM
- Posted Re: Microsoft Graph Security API Add-on configuration issue on All Apps and Add-ons. 07-15-2020 03:10 AM
- Posted Re: Microsoft Graph Security API Add-on configuration issue on All Apps and Add-ons. 07-15-2020 02:03 AM
- Posted Microsoft Graph Security API Add-on configuration issue on All Apps and Add-ons. 07-14-2020 12:59 PM
- Karma Re: How to configure Splunk to receive syslogs from Cisco Meraki MX? for skalliger. 06-05-2020 12:50 AM
- Posted Splunk alert result(s) to a dashboard input and then email results on Alerting. 02-19-2020 08:27 AM
- Tagged Splunk alert result(s) to a dashboard input and then email results on Alerting. 02-19-2020 08:27 AM
- Tagged Splunk alert result(s) to a dashboard input and then email results on Alerting. 02-19-2020 08:27 AM
- Tagged Splunk alert result(s) to a dashboard input and then email results on Alerting. 02-19-2020 08:27 AM
- Tagged Splunk alert result(s) to a dashboard input and then email results on Alerting. 02-19-2020 08:27 AM
- Posted Re: I am getting mostly info=denied events for specific users while searching for _audit index. While user can no longer query any indexes. Does that info indicates permission issues? or something else. on Splunk Search. 08-05-2019 08:41 AM
- Posted I am getting mostly info=denied events for specific users while searching for _audit index. While user can no longer query any indexes. Does that info indicates permission issues? or something else. on Splunk Search. 08-02-2019 05:25 PM
- Tagged I am getting mostly info=denied events for specific users while searching for _audit index. While user can no longer query any indexes. Does that info indicates permission issues? or something else. on Splunk Search. 08-02-2019 05:25 PM
- Posted Re: For Symantec Web Security Service App for Splunk and TA - Events are getting indexed in "main" index only on All Apps and Add-ons. 05-06-2019 11:16 AM
- Posted Re: For Symantec Web Security Service App for Splunk and TA - Events are getting indexed in "main" index only on All Apps and Add-ons. 05-06-2019 11:15 AM
- Posted Re: For Symantec Web Security Service App for Splunk and TA - Events are getting indexed in "main" index only on All Apps and Add-ons. 05-06-2019 11:12 AM
- Posted For Symantec Web Security Service App for Splunk and TA: Why are events getting indexed in "main" index only? on All Apps and Add-ons. 05-02-2019 11:18 AM
- Tagged For Symantec Web Security Service App for Splunk and TA: Why are events getting indexed in "main" index only? on All Apps and Add-ons. 05-02-2019 11:18 AM
- Tagged For Symantec Web Security Service App for Splunk and TA: Why are events getting indexed in "main" index only? on All Apps and Add-ons. 05-02-2019 11:18 AM
- Tagged For Symantec Web Security Service App for Splunk and TA: Why are events getting indexed in "main" index only? on All Apps and Add-ons. 05-02-2019 11:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-15-2020
03:10 AM
Thank you, I can see the option in config tab to add a new account.
... View more
07-15-2020
02:03 AM
What is the core version? 7.2.9.1 Graph API Version? 1.1.0 and OS? 3.10.0-514.el7.x86_64
... View more
07-14-2020
12:59 PM
I have just install Microsoft Graph Security API Add-on and set up Application / Accesses at Azure end, however when I go into the configuration tab to add a new account, I just see a loading scroll and dont see any button to "ADD" account config. Have anyone encounter the same? if so please share how you resolve it.
... View more
Labels
- Labels:
-
configuration
-
installation
02-19-2020
08:27 AM
How can I send alert result(s) to a dashboard input and then email dashboard results? Please let me know if anybody has worked on this before. thank you!
... View more
08-05-2019
08:41 AM
hi @Sukisen1981 I was unclear in my question about _audit index, I was seeing this info=denied in _audit index for a user as a splunk admin and yes later I was able to figure out access issues causing users not able to search any indexes. thank you for your comments and sorry about being unclear initially.
... View more
08-02-2019
05:25 PM
I am getting info=denied events for specific users while searching for _audit index. What is the significance of this as users are not able to search any indexes? any leads.
... View more
- Tags:
- splunk-enterprise
05-06-2019
11:16 AM
@scottprigge - thanks!
... View more
05-06-2019
11:15 AM
@adobrzeniecki_splunk yes, when you defined modular input through GUI it gets created in App however I defined through CLI in TA under local/inputs.conf, that worked too!
... View more
05-06-2019
11:12 AM
@lakshman239 - yes I defined new index in local inputs.conf, however there were batch input which required new index definition -
[batch://$SPLUNK_HOME/var/spool/splunk/...stash_ta_scwss_logs.zip]
index = new index
... View more
05-02-2019
11:18 AM
TA-SymantecWebSecurityService pulls data from Symantec Web Security Service via REST endpoint. I installed Symantec Web Security Service App for Splunk and TA, events are indexing in "main" index only. I defined separate index for this App and referenced in input.conf. Still can not figure out why events are indexing in main index. Any lead will be helpful. Thank you!
... View more
- Tags:
- endpoint
- index
- main
- Monitoring for Splunk
- rest
- Symantec Web Security Service (WSS) Add-on for Splunk
- Symantec Web Security Service (WSS) App for Splunk
Labels
03-01-2019
07:52 AM
Is there any App or Add-on to ingest Macfee Skyhigh casb logs?
Have anyone ingested this in Splunk before? Have lead would be appreciated.
... View more
02-28-2019
02:48 PM
Palo Alto App : Is there any best practice to update sanctioned_saas.csv with sanctioned SaaS app list?
... View more
02-27-2019
09:11 AM
yes, Like I mentioned removing this field displays results. So I can definitely remove this field. thank you for your input.
... View more
02-26-2019
11:21 AM
I've recently started ingestion of wildfire events in Palo Alto app. Dashboard "Wildfire Submission" seems broken. I looked into the query forming those panels. One of the query I would like to mention here -
| tstats summariesonly=t count FROM datamodel="pan_firewall" WHERE nodename="log.wildfire" """" groupby _time log.rule log.src_ip log.dest_ip log.verdict log.file_name log.file_type log.user log.app log.file_hash log.src_location
Field "file_name" is breaking this query result which is coming from nodename=log.wildfire which in-turn populating from data model pan_firewall. Removing this field will show result count and remaining fields.
Upon looking into the datamodel I see this field as optional and atleast 50% raw events contain field file_name from this sourcetype.
Any lead would be helpful.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-15-2020
06:36 AM
|
