Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About panguy
panguy
Contributor
Member since:
05-03-2016
05-01-2023
Community Statistics
| Posts | 86 |
| Solutions | 14 |
| Karma Given | 7 |
| Karma Received | 22 |
| Member Since | 05-03-2016 |
Activity Feed
- Got Karma for Re: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied. 4 weeks ago
- Posted How do you add an external link in Splunk Monitoring Console Health Check checklist.conf on Building for the Splunk Platform. 04-28-2023 02:55 PM
- Tagged How do you add an external link in Splunk Monitoring Console Health Check checklist.conf on Building for the Splunk Platform. 04-28-2023 02:55 PM
- Tagged How do you add an external link in Splunk Monitoring Console Health Check checklist.conf on Building for the Splunk Platform. 04-28-2023 02:55 PM
- Posted Re: Add-on Builder 4.1.2 Detected an outdated version of the Splunk SDK for Python (1.6.6) on Building for the Splunk Platform. 03-09-2023 10:00 AM
- Posted Add-on Builder 4.1.2 Detected an outdated version of the Splunk SDK for Python (1.6.6) on Building for the Splunk Platform. 03-09-2023 09:54 AM
- Got Karma for Re: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied. 11-16-2022 06:11 PM
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 09-28-2021 06:50 AM
- Posted Re: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied on Installation. 11-25-2020 01:21 PM
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 11-11-2020 12:49 PM
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 10-05-2020 11:46 AM
- Posted Re: Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-05-2020 08:28 AM
- Karma Re: Why is App Inspect failing in inputs.conf.spec? for thambisetty. 08-05-2020 08:28 AM
- Posted Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Tagged Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Tagged Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Got Karma for Re: Palo Alto Networks global protect only shows one month of data. 06-05-2020 12:50 AM
- Got Karma for Re: Palo Alto Add-on CIM Network_Traffic, can we map only end events?. 06-05-2020 12:50 AM
- Karma Re: Error at search time after upgrading Palo Alto Networks App for Splunk to version 6.0 for rphillips_splk. 06-05-2020 12:49 AM
- Got Karma for Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
04-28-2023
02:55 PM
I'm trying to figure out how do we add an external link to documentation in checklist.conf. This is for a healthcheck that will be run in the Splunk Monitoring Console. Here is an example from the System Hardware provisioning assessment health check: [system_hardware_provisioning_assessment]
title = System hardware provisioning assessment
category = System and Environment
tags = best_practices, capacity, scalability
description = This evaluates the hardware specifications of Splunk instances tasked with indexing and/or searching data, using reference hardware.
failure_text = One or more hosts has returned CPU or memory specifications that fall below reference hardware recommendations. This might adversely affect indexing or search performance.
suggested_action = If you are experiencing performance issues, consider upgrading hosts to meet or exceed the recommended hardware specs.
doc_link = healthcheck.hardware.reference
doc_title = recommended minimum hardware
applicable_to_groups = dmc_group_search_head,dmc_group_indexer
search = | rest $rest_scope$ /services/server/info \
| eval cpu_core_count = if(isnotnull(numberOfVirtualCores), numberOfVirtualCores, numberOfCores) \
| eval physical_memory_GB = round(physicalMemoryMB / 1024, 0) \
| fields splunk_server cpu_core_count physical_memory_GB \
| eval severity_level = case(cpu_core_count <= 4 OR physical_memory_GB <= 4, 2, cpu_core_count < 12 OR physical_memory_GB < 12, 1, cpu_core_count >= 12 AND physical_memory_GB >= 12, 0, true(), -1) \
| rename splunk_server AS instance cpu_core_count AS "cpu_core_count (current / recommended)" physical_memory_GB AS "physical_memory_GB (current / recommended)" \
| fieldformat cpu_core_count (current / recommended) = 'cpu_core_count (current / recommended)'." / 12" \
| fieldformat physical_memory_GB (current / recommended) = 'physical_memory_GB (current / recommended)'." / 12" the doc_link isn't a URL but it does link to : https://docs.splunk.com/Documentation/Splunk/9.0.4/Capacity/Referencehardware?ref=hk How can I link to an external doc?
... View more
03-09-2023
10:00 AM
My work around: Manually update splunklib to the latest version by downloading the latest version of the Splunk SDK. SDK: https://github.com/splunk/splunk-sdk-python/ Extract and copy the splunklib directory to ../aob_py3/solnlib/packages/splunklib
... View more
03-09-2023
09:54 AM
After updating my add-on to 4.1.2 I am getting this error during certification: check_python_sdk_version Detected an outdated version of the Splunk SDK for Python (1.6.6). Please upgrade to version 1.6.16 or later. File: bin/add-on/aob_py3/solnlib/packages/splunklib/binding.py
... View more
11-25-2020
01:21 PM
2 Karma
I had this same problem when upgrading Splunk. After untaring the TGZ file to my $SPLUNK_HOME. cd $SPLUNK_ROOT_DIR
ls -lah This confirmed the owner of the folder changed to 10777 I went ahead and ran this line to fix permissions chown -R splunk:splunk $SPLUNK_HOME In your case change the user to root. Hope that helps.
... View more
- Tags:
- It helps.
08-05-2020
08:28 AM
Thank you. The App Inspect error is misleading. It makes it seem like we need to add it into inputs.conf.spec file. I removed it from inputs.conf.spec and added it to only inputs.conf and it now passes.
... View more
08-04-2020
09:08 PM
I am currently getting this failure when running my add-on through appinspect:
check_inputs_conf_spec_stanzas_has_python_version_property
My README/inputs.conf.spec
[autofocus_export://<name>]
python.version = python3
label =
interval =
AppInspect Report:
Modular input "autofocus_export" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 1
Current documentation for inputs.conf.spec doesn't mention using python.version. Any help would be appreciate
... View more
Labels
- Labels:
-
add-on
-
modular input
-
python
06-02-2020
03:24 PM
3 Karma
try commenting out line 125, 126 173, 174 from props.conf in Splunk_TA_paloalto. This answer works as of version 6.2.0 of the add-on.
... View more
06-02-2020
03:17 PM
what lines did you comment out? I'm assuming your commenting props.conf
... View more
06-02-2020
03:04 PM
Sorry, I didn't realize there is no option to disable it from the GUI. Commenting it out should work. Did you restart the instances?
... View more
06-02-2020
01:59 PM
Have you tried disabling the automatic lookups from the "Lookups" setting page?
... View more
06-02-2020
01:42 PM
I may need a little more context. Firewall logs are generally forwarded to the Splunk instance. Splunk shouldn't need to authenticate with a Firewall to get logs.
... View more
06-02-2020
09:42 AM
The Palo Alto Networks add-on was built using Splunk's Add-on builder and leverages Splunk's credentials encryption method from the settings page.
... View more
05-13-2020
03:00 PM
Please open Browser Inspector and click on the network tab. Let me know what files are showing up as 404.
... View more
03-11-2020
04:58 PM
Yes, I can confirm this is a breaking update for GlobalProtect.
GlobalProtect now has its own log type. It is no longer apart of the system log type. We will be updating the app and add-on to reflect this change.
Since GlobalProtect has it's own log type, you need to activate log forwarding for GlobalProtect. This can be done at Device -> Log Settings. You will see a new section for GlobalProtect as well as IP-TAG logs. Add a filter to the section to forward logs.
... View more
02-27-2020
03:10 PM
This is a known issue with Cortex that is planned to be fixed. The empty value was in place of a serial number. In the future there will be a value here to signify this is coming from Cortex. Temporary work around is to change the REGEX to ^[^,]+,[^,]+,[^,]?+,THREAT,
... View more
09-05-2019
12:21 PM
I have gone ahead and added 7.3 as supported on both the app and add-on. Thank you.
... View more
08-08-2019
08:42 AM
Unfortunately, we don't have documentation on rsyslog. Essentially you want to make sure rsyslog does not do any type of parsing before it forwards to Splunk. You will need to check documentation on how to do this with rsyslog.
... View more
08-06-2019
10:31 AM
This might be an issue with your syslog-ng server. I would recommend checking the config on the syslog server. Did you follow this guide: https://splunk.paloaltonetworks.com/universal-forwarder.html?
... View more
08-05-2019
09:29 AM
Are you seeing 2 entries in splunk that are the same or 1 entry in splunk with 2 lines of the same log?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-01-2023
01:14 AM
|
Karma from
Karma given to
