Hi Joerglang, Not sure if you saw this presentation, but this is what they are doing here in this .conf 2017 talk:  https://conf.splunk.com/files/2017/slides/splunking-with-multiple-personalities-extending-role-based-access-control-to-achieve-fine-grain-security-of-your-data.pdf It would be nice to see row-level security natively built in though. ... View more

the curl command in #4 is malformed... opening curly is missing, auth token? or it should be empty? ... View more

Here is an dashboard I have made to find out what are going on. <form version="1.1" theme="dark"> <label>Deployment status</label> <!-- 1.0 1.1 change name 19.12.2019 --> <search id="base_search"> <query> index=_internal OR index=*_internal sourcetype=splunkd host="$Host$" name="$Server$" sc="$Stansa$" app="$App$" result="$Result$" action=Download | table _time host name sc app result </query> </search> <fieldset submitButton="false"> <input type="time"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="Host"> <label>Deployment server</label> <search base="base_search"> <query> | eval data=host | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Server"> <label>Server</label> <search base="base_search"> <query> | rex field=name "bit_(?&lt;server&gt;[^_]+)" | eval data=name | stats count by data server | eval info=server." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Stansa"> <label>Stansa</label> <search base="base_search"> <query> | eval data=sc | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="App"> <label>Application</label> <search base="base_search"> <query> | eval data=app | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="Result"> <label>Result</label> <search base="base_search"> <query> | eval data=result | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>Fail</default> </input> </fieldset> <row> <panel> <chart> <search base="base_search"> <query> timechart count by name limit=10 </query> </search> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> </chart> </panel> </row> <row> <panel> <table> <search base="base_search"> <query> stats count by host name sc app result | sort result | rename host as "Deplyment server" name as Server sc as Stansa app as Application </query> </search> <option name="count">100</option> <format type="color" field="Deplyment server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="Server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="Stansa"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="Application"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="result"> <colorPalette type="map">{"Fail":#DC4E41,"Ok":#53A051}</colorPalette> </format> </table> </panel> </row> </form> ... View more

Hi, super long shot, but was a solution ever found to this? We seem to be having this issue right now. Last week all the host fields were parsed to include the domain part, this week they are back to being hostname only. I've compared 2 logs from the same host, with the same event ID. The only difference I can see in the logs is that dvc_nt_host is different between the 2, while dvc is the fqdn on both. Which is super off because this line is in the props.conf of the Windows TA app  FIELDALIAS-dvc = host as dvc, host as dvc_nt_host   ... View more

Hey There, i want to push this threat and ask if somethings changed since 2016?  I have the same question, need to delete and post data to a KV store and do not want to grand Admin level permissions to a user just for that.  ... View more

This was a fantastic solution all around, can I ask how you would get the stats version of this to work in a props & transforms?  ... View more

Did you ever manage to get a solution to this? I can also get the sessionKey with  auth.getSessionKey('admin','<password for admin>') but I also don't want to hardcode the password.  ... View more

HI! It seems like you might see where i am having trouble with the if statement. Thank you in advance! I have a field called Status, and once of the values is called Queue. I want to replace the word Queue with either Risk or Missed - that is dependent on another field called Dep. So if  Dep=Risk, then the Queue value should be renamed Risk, and if Dep=Missed, then Queue value should be renamed as Missed. Here is my search: | eval Status = if(Status="Queue", (case(Dep="RISK", RISK), (Dep="MISSED", MISSED))) ... View more

Provide your users with bookmarklets, which allow them - with a button click from the browser bookmark bar, to change the mode: Change to Light Mode javascript:void((function(){var loc = location.href; if (loc.indexOf('theme') >= 0) return; loc.indexOf("?") < 0 ? (location.href = loc+"?&theme=light") : (location.href = loc+"&theme=light");})()); Change to Dark Mode javascript:void((function(){var loc = location.href; if (loc.indexOf('theme') >= 0) return; loc.indexOf("?") < 0 ? (location.href = loc+"?&theme=dark") : (location.href = loc+"&theme=dark");})()); I can't make these hyperlink bookmarklets here in Splunk Answers, so you would need to provide it to your users, rather than point them to this question. If you or your users aren't familiar with bookmarklets, they click and drag the bookmark link to their bookmark bar. Then click it when they want it to perform something. More details here: https://en.wikipedia.org/wiki/Bookmarklet ... View more

Have you tried using URL Encoding? As an example, you could POST a name to have it encoded by curl: curl --data-urlencode "apple=very red" http://example.com …which would send the following data in the actual request body: apple=very%20red The following site has a full explanation and examples of this with curl: https://ec.haxx.se/http-post.html ... View more

Catch 22 - if you go with the Cb Protect app from Carbon Black, you don't get CIM compliant tags, so it won't likely work with Enterprise Security. At least there's no mention that the Cb Protect app is CIM compliant. ... View more

we no longer have cylance so it's a moot point for us... 🙂 ... View more

Splunk even adds a little symbol to the link to indicate that it opens in a new tab. ... View more

Hi Tony, You can try forwarding those logs using syslogger. HEC is a valid option but the major drawback is the data loss in case of receiver (HF) down. ... View more

And I would like to highlight to you that the statistic (e.g. Total Malicious Email, Attachement) are not correct. This is because fireeye sends two or more events for single email if the email attachment is zipped. It can't simply count the user or hash. The logic may be complex. ... View more

The funny thing is that when we deploy the apps via the deployment server, we specify the servers in the serverclass.conf and we specify them using FQDN. So, why does the software determine the host name by itself after discovering it via set-up in serverclass.conf ? which leads to these very annoying discrepancies. So, it would be nice if there was a way to carry the name from the serverclass.conf to inputs.conf of the forwarder. It's true that sometimes, we specify a set of hosts in serverclass.conf using wildcards, which might make the transition more complex. ... View more

This works! Thanks. ... View more

@samsingnok52 , this question is more than a year old and so you are unlikely to see many responses to your comment. You should post a new question describing your problem. ... View more

Until about a year ago there was a Hunk app for Accumulo. However, that App is no longer on splunkbase. A person can write such a thing using these sample apps: https://splunkbase.splunk.com/apps/#/search/hunk ... View more

Good day, this does not seem related to the original question asked--thus you may want to open a new question for proper tracking. This also seems like more of a Splunk question and not so much of a FireEye App specific question. You may want to contact your Splunk rep as well to see if they know the answer. I can only guess that the data is being split into multiple parts due to improper line breaking? Did you try changing the format? It appears you are using JSON in the same above. Can you try to switch to TCP syslog CEF and see if you still have the same issue? Feel free to email via Help -> Send Feedback from within the app and we can try to troubleshoot a bit as well. Hope that helps. ... View more

incredibly helpful, thank you! ... View more

Hi Tony Not sure. Are you using Nessus 5.x? what are the fields you want to extract? you may have to update the script in the file to extract new fields. ... View more

Im running a All-in-one Server, so my search head and indexer is the same. Will this be an issue? ... View more

Yes, this was also reported here: https://answers.splunk.com/answers/365911/small-bugreport-about-version-121.html I have just added a Known Issue to the documentation here: http://docs.splunk.com/Documentation/AddOns/released/CiscoESA/Releasenotes#Known_issues so that you can follow along as this gets fixed. Thanks! ... View more