Thanks for the prompt reply @ehaddad_splunk, and thanks for your work on this AddOn! It's a great addition to our SIEM solution in ES. Our Security team's workaround at the moment is using an older 8.0.4.1 Heavy Forwarder (HF) to run this specific SolarWinds AddOn, while the rest of the SplunkBase Apps are running on our recently upgraded 8.1.0 HF.  It's odd that the SplunkBase page shows Version 1.1.0 (March 30, 2020) as COMPATIBILITY for 8.1, as tho it had been properly vetted for release. However, if you look inside the TGZ download, there isn't the same aob_py2 and aob_py3 folders that we see in other 8.1 compatible apps from SplunkWorks , such as "Microsoft Azure Add on for Splunk" (June 2020): ... View more

We are also encountering this issue. Addon works fine with Splunk Enterprise 8.0.x, but fails when upgrading (or even fresh installs) on 8.1.x. We also opened a Support ticket, but was immediately Rejected for the Unsupported App: Having said that, there does appear to be a bit of interest from the Community and Splunk answers so hopefully the developers will see that. I note the latest version 1.1.0 was released in March 2020, well before Splunk 8.1, so as you have suggested it's not finding the right python libraries etc. Looks like the author @ehaddad_splunk  (?) is our only hope for an update.   ... View more

Hi @ranade , I'm afraid I don't have a reply for this one yet, but I'd like to get back to you once we implement it! May I inquire if you have a link to documentation for your solution to send "Cortex XDR sending data via TCP SSL to Splunk"? Is that just a standard TCP-Input on Splunk side?  https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports My Security team is indicating that Cortex-XDR is only capable of API. Thanks! ... View more

Thanks for the reply, but not exactly the answer I'm looking for... CLARIFICATION OF MY PROBLEM STATEMENT: I need to capture every IP found in all logs, regardless of Index/host/source/sourcetype. A single weblog from a busy webserver could yield 1000's of IPs for each unique client requesting a popular webpage. I'm not concerned about Hostnames. CLARIFICATIONS TO YOUR QUESTIONS: Example is anything between 0.0.0.0 and 255.255.255.255. Regex taken from www.regular-expressions.info/ip.html and verified with regex101.com The idea for "rex field=_raw" is taken from this: https://answers.splunk.com/answers/656616/how-to-extract-ip-address-using-regex.html It is applying to every RAW event, regardless of sourcetype or log format. TESTING: I tested your pipeline "| dedup ip | sort ip | table ip" , and job-inspector shows that it actually takes longer than the single "| stats values(ip)" pipe. They yield the same results, with slightly different sort (string rather than Integer) ... View more