We have already enabled the Splunk logging driver,  but this forwards logs from inside the containers.   I want to capture the docker system-level events, as you would see from this command:     docker events --filter event=stop --since '60m'     https://docs.docker.com/engine/reference/commandline/system_events/   I see this app (not approved for cloud).   Are there any other options? https://splunkbase.splunk.com/app/6113 https://github.com/quzen/docker_analyzer/blob/main/bin/docker_events.py ... View more

I have an Adaptive Response Action (execute_flow in the pic below)  that requires certain identity data about the subject of the notable (mobile phone number).   Not all users have a mobile number set in ES identity. Currently,  I throw a failure event in Python for this condition.   Is it possible to return a warning status instead?   ... View more

I was expecting to find a helper object function for this, but I don't see one here: https://docs.splunk.com/Documentation/AddonBuilder/4.1.1/UserGuide/PythonHelperFunctions I want to use the DNS name/URL of the search head in my alert action code.   How can this be accessed (Splunk cloud, if it matters)?    At least in my local test server,  I see this, but it returns an IP address, not a DNS name. helper.settings["server_uri"] ... View more

We have been using WEF as our collection point for a while.  We started out small but have expanded the range of events over time.   We have ~5,000 hosts forwarding to a single collector. The collector is busy, but seems to be healthy based on conventional Windows indicators. However,  we have some data loss between the centralized event and Splunk (cloud).   Logs show up in the WEF collection log but never make it to the index.   First,   are there any performance tuning suggestions you can offer UF on a WEF collector? Second,  can you think of any way to check on processing of a single event once it goes into the UF and heads to the indexer? ... View more

The add-on fails to line break JSON docs into separate events/logs when pulling from an event hub. Certain Azure services seem to write multiple JSON docs to a single event hub message. Is there an option to correct this parsing? {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": "......... {"body":{"records": {"DataCenterName": "East US 2", "DeploymentUnit": "xyz", "EventId": 160, "EventName": "AzureBackupCentralReport", "properties": {"VaultUniqueId": ".........   ... View more

Neither of these ASN lookup apps is available in Splunk Cloud.    Does anybody know of an alternative? ASN Lookup Generator   https://splunkbase.splunk.com/app/3531/   SecKit for geolocation with MaxMind  https://splunkbase.splunk.com/app/3022/   ... View more

I see this message in the _internal log so I know the action was called, but I don't have any further clues about the issue.     Invoking modular alert action=sendresults_alert for search="Stale AD Users" sid="scheduler_aGtlbGxleUBzb21wby1pbnRsLmNvbQ__search__......." in app="search" type="saved"      The report also has a regular send email action,  which did work. Running on Splunk Cloud   ... View more