Hi there, I´m getting following advice on licensing page: "This deployment is subject to license enforcement. Search is disabled after 45 warnings over a 60-day window" I don't know what it´s are referring to.   ... View more

Hello all! I´m so lost trying to get full process tree to visualize it in dendogram https://splunkbase.splunk.com/app/5153/ , i hope anybody could help me Data example: parent sourceProcess child destinationProcess 906 PanGpHip.exe 942 cmd.exe 906 PanGpHip.exe 934 cmd.exe 906 PanGpHip.exe 938 cmd.exe 906 PanGpHip.exe 930 cmd.exe 906 PanGpHip.exe 926 cmd.exe 906 PanGpHip.exe 921 cmd.exe 906 PanGpHip.exe 913 cmd.exe 246 PanGPS.exe 906 PanGpHip.exe 16 svchost.exe 242 RuntimeBroker.exe 6 services.exe 243 sppsvc.exe   Data needs to be show as following capture to work     ... View more

Hello, I´m trying to load custom rex field extraction if another field has a certain value, for example: if logtype=system      then                search | rex field=_raw ..... if logtype= application       then                search | rex field=_raw .... logtype username _raw system   user=002 application   suser=004   Thanks in advance! ... View more

Hi all, I´ve a custom command but it requieres python3 for launch properly. Errors on job inspector: 09-17-2019 13:49:30.497 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/arcsightapi/bin/bypass.py 09-17-2019 13:49:30.666 ERROR ChunkedExternProcessor - stderr: Error in sitecustomize; set PYTHONVERBOSE for traceback: 09-17-2019 13:49:30.666 ERROR ChunkedExternProcessor - stderr: AttributeError: module 'sys' has no attribute 'setdefaultencoding' 09-17-2019 13:49:30.666 ERROR ChunkedExternProcessor - Failed attempting to parse transport header: module 'requests.packages.urllib3' has no attribute 'disable_warnings' if i exec under terminal with python3 support works nice: root@horsell:/opt/splunk/bin# ./splunk cmd python3 ../etc/apps/arcsightapi/bin/client.py -h Error in sitecustomize; set PYTHONVERBOSE for traceback: AttributeError: module 'sys' has no attribute 'setdefaultencoding' usage: client.py [-h] [-a AREA] [-s SOURCE] [-q SEARCH_QUERY] [-ts START_QUERY] [-te END_QUERY] [-tl TIME_LIMIT] Any idea to solve this? Regards. ... View more

Hi all, I am trying to make a correlation between an inventory of assets and vulnerability indexed data. I am currently using: | lookup assets.csv vendor, product,version OUTPUT Hostname Delivery | where isnotnull (Delivery) to get exactly which assets appear in the indexed data and are therefore vulnerable, however there is a limit of 1000 when using lookup files. By trying to solve the problem, I have indexed the inventory data in "index = assets", how could I get the relation of vulnerable assets with data indexed in two different indexes? Thanks in advance ... View more