Had infoblox syslog onboarded via syslog-ng which prepended date hostname to syslog event On the searchhead cluster have the correct Splunk_TA_infoblox ver 1.1.0 and the props.conf/transforms.conf has a number of fields that should extract on search but nothing extracts dns_request dns_request_src dns_request_record_type example: props.conf [infoblox:dns] #Reports REPORT-dns_extract = dns_request, dns_request_src, dns_request_record_type REPORT-dns_extract_2 = dns_response,dns_incepted,dns_records_extract, dns_response_src,dns_response_dest, dns_response_record_type REPORT-dns_rpz_extract = dns_rpz_cef_0 REPORT-dns_fields_1 = infoblox_dns_extract_field_0, infoblox_dns_extract_field_1, infoblox_dns_extract_field_2, infoblox_dns_extract_field_3, infoblox_dns_extract_field_4, infoblox_dns_extract_field_5,infoblox_dns_extract_field_6, infoblox_dns_extract_field_8, infoblox_dns_extract_field_9, infoblox_dns_extract_field_10 REPORT-dns_fields_2 = infoblox_dns_extract_field_11, infoblox_dns_extract_field_12, infoblox_dns_extract_field_13, infoblox_dns_extract_field_14, infoblox_dns_extract_field_15, infoblox_dns_extract_field_16, infoblox_dns_extract_field_17 REPORT-dns_rpz_fields_1 = infoblox_dns_rpz_qname_fields example transforms.conf [dns_request] REGEX = client\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:::)?(?:[a-zA-Z\d]{1,4}::?){1,7}[a-zA-Z\d]{0,4})#(?\d+).*\s(?query):\s(?\S+)\s(?\w+)\s(?\w+)\s(?(?:\+|\-)\S*)\s\((?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:::)?(?:[a-zA-Z\d]{1,4}::?){1,7}[a-zA-Z\d]{0,4})\) [dns_response] REGEX = \S+\s+(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\snamed\[(?\d+)\]\:\s(?:infoblox-responses:\s)?(?\S+)\s(?\S+)\sclient\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:::)?(?:[a-zA-Z\d]{1,4}::?){1,7}[a-zA-Z\d]{0,4})#(?\d+)?[\D]*\s(?\w+):\squery:\s(?\S+)\s(?\w+)\s(?\w+)\s(?response):\s(?\w+)\s(?\S+)\s?(?[\S+\s+]*)? [dns_records_extract] REGEX = (?\S+)\s(?\d+)\s(?\S+)\s(?\S+)\s(?\S+) SOURCE_KEY = dns_record MV_ADD = true [dns_incepted] REGEX = (?[^;]+) SOURCE_KEY = dns_response_RR_in_TEXT MV_ADD = true [dns_request_src] REGEX = (?.+) SOURCE_KEY = dns_request_name_serverIP [dns_response_src] REGEX = (?.+) SOURCE_KEY = dns_response_client_ip [dns_response_dest] REGEX = (?.+) SOURCE_KEY = server_ip [dns_request_record_type] REGEX = (?.+) SOURCE_KEY = dns_request_type_name [dns_response_record_type] REGEX = (?.+) SOURCE_KEY = dns_response_type_name example of event Nov 19 16:18:20 INFOBLOXHOST named[18123]: 19-Nov-2019 16:18:20.992 client X.X.X.X#58840: view 2: UDP: query: client.cldomain.net IN A response: NOERROR + client.cldomain.net. 60 IN A Y.Y.Y.Y Does anyone have any experience with this TA and do I need to do custom extractions instead of using the TA ? ... View more

I'v installed TA-Azure_Monitor on HF to get Azure Monitor activity log and followed all instructions. When TA is enabled get error in splunkd.log that azure_activity_log.sh has error getting eventhub credentials because it is looking for self signed certificate added to chain. Does anyone know how this is done ? ... View more