index="pan_logs" sourcetype="pan:traffic" dest_ip="91.226.0.0/16" | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS remotehost | table _time dest_ip dest_port remotehost | where dest_port!=48600 OR dest_port!=22 ... View more

Note: This is NOT disabling SplunkWeb. A UF does not have SplunkWeb ever at all, period. This is disabling the REST API server. This has side effects on the UF, such that the CLI largely (but not completely) quite working. See Matt's .conf talk: http://conf.splunk.com/files/2016/recordings/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.mp4 http://conf.splunk.com/files/2016/slides/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.pdf ... View more

Hi aakwah Thanks for this. I assume this requires me to index the data into splunk. Is there no way to just pull the data via a lookup without indexing it and run a report based on it. I only have a 1Gb data license and didn't particularly want to index anything just for this size report which will only be running 2 times a day at most ... View more

Hi Thanks for that. I was assured this was installed... It is now and the Thirdman app is now working correctly ... View more