About gstefancyk

gstefancyk · ‎11-25-2019

After upgrading to version 5.0.0 of the add on 100s of lea_loggrabber processes keep spawning and eventually lead to resource contention issues. We need to pkill lea_loggrabber and restart splunk to get things working again. Then a couple of hours later we have multiple processes running again and if we let it go this easily goes into the couple hundreds. Anyone have any solutions?

gstefancyk · ‎11-20-2019

Was able to find this out by reading some additional documentation that is not part of the release notes or upgrade notes for 5.0 of add on. https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usescriptedalerts In version 3.1 you did not need to specify the account name directly in your searches in order to use scripted alert action "snow_incident.py" This is quite a simple fix but it is not clearly documented and should be part of the release/upgrade notes. If you use "snow_incident.py" and are migrating to version 5.0 from 3.1 or earlier you must specify the account name in your search. | eval account = "accountname" The account name is the name you gave the account when you set up the integration in the add on.

gstefancyk · ‎11-20-2019

Do you happen to know the difference between these files? service_now.conf splunk_ta_snow_settings.conf It appears in the new version of the add on splunk_ta_snow_settings.conf was added. Notice when restarting splunk it also complains about all of the settings in the "service_now.conf" nvalid key in stanza [snow_account] in /opt/splunk/etc/apps/Splunk_TA_snow/local/service_now.conf, line 4: password (value: ). Invalid key in stanza [snow_account] in /opt/splunk/etc/apps/Splunk_TA_snow/local/service_now.conf, line 5: release (value: Madrid). Invalid key in stanza [snow_account] in /opt/splunk/etc/apps/Splunk_TA_snow/local/service_now.conf, line 6: url (value: https://x.x.x.service-now.com). Invalid key in stanza [snow_account] in /opt/splunk/etc/apps/Splunk_TA_snow/local/service_now.conf, line 7: username (value: ). That is making me think that that service_now.conf is deprecated or something? Nothing is noted in the documentation though.

gstefancyk · ‎11-20-2019

Hi @uagrawal_splunk we have already done that as that is a requirement when upgrading. We are able to pull data using the same exact user account as well. We just cannot execute the script "snow_ticket.py" as it cannot find the user account. We use this as a scripted input on our alerts to trigger SNOW tickets. GS

gstefancyk · ‎11-20-2019

snow_incident.py is no longer able to run after updating to add-on version 5.0. It cannot actually find the configured account in the add-on. Has anyone run into this issue? 2019-11-20 08:20:11,022 ERROR pid=175755 tid=MainThread file=snow_ticket.py:_get_service_now_account:226 | Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_snow/bin/snow_ticket.py", line 170, in _get_service_now_account raise Exception("Account name cannot be empty. Enter a configured account name or create new account by going to Configuration page of the Add-on.") Exception: Account name cannot be empty. Enter a configured account name or create new account by going to Configuration page of the Add-on. There is definitely an account configured in the add on and it is working. Thanks, Gary S.

gstefancyk · ‎12-18-2018

@jaxjohnny2000 Did you ever get the additional fields to extract properly? Running into the same issues, edited props.conf to look at proper Eventtype but some of the fields are still not extracting properly. For example, Action, By_User and plenty of others. The regex appears to be correct and when tested with rubular as well as the splunk custom field extractor we get the expected results, but they do not carry over into search...

gstefancyk · ‎02-28-2018

Thanks FrankVI, exactly what I expected but nice to get some re-assurance.

gstefancyk · ‎02-13-2018

We have been ingesting our Check Point logs via the Check Point OPSEC LEA add-on and finally realized that the HOST being reported is always our management station IP where we are pulling logs from... Is there a way to change this in the OPSEC Lea add on or would we be better off doing this in transforms.conf and props.conf on the heavy forwarder?

gstefancyk · ‎01-31-2018

Thanks maciep, works as expected after adding 3rd column to my lookup table.

gstefancyk · ‎01-31-2018

Thanks for the suggestion, I will give this a try and see happens.

gstefancyk · ‎01-26-2018

I currently have an alert setup to send email when one of our infoblox servers stops sending logs based on metadata of the index and a csv lookup for hosts. This works well but the issue I am running into is that some of the devices are in an HA pair so I am constantly getting emails for the backup device not reporting. Below is my current search, | metadata type=hosts index=infoblox | lookup infoblox_hosts.csv host_ip as host OUTPUT host_ip as host, server_name as server | search host=* | where lastTime < (now() - 86400) | convert ctime(lastTime) as LastTimeLogged | table host,server LastTimeLogged | sort LastTimeLogged Can someone point me in the right direction to setup a condition to alert when both server1 and server2 have stopped reporting otherwise do nothing? Thanks

gstefancyk · ‎12-11-2017

Hi Gordo32, Have you tried creating your alerts under the context of the Snow app and triggering the script from the default location? I had a similar issue trying to move the script to another location so I ended up just building my searches/alerts under the Splunk_TA_Snow app. Hope that helps.

gstefancyk · ‎10-20-2017

Thanks Giuseppe, I don't see any issue with indexing from DMC. As I noted our other search head is still able to search with no issues. Our indexer storage should not be a problem as we are running Raid10 on 8 1.6TB SSD's. The indexer and search heads are physical machines.

gstefancyk · ‎10-20-2017

I have two separate search heads, one for admins to use and another for regular users. The search head for admins once or twice a week will need to have splunk service restarted in order to read from the indexer again. Looking in the distributed search peers settings it shows the indexer as "Up", "Healthy" and with no failed health checks. When searching from this indexer on any index, no results are returned, almost as if it cannot talk to the indexer. Running a tcpdump on both the indexer and problematic search head shows bidirectional traffic between the two hosts with no issues. Our other search head is still working fine and returning results so we know data is still being indexed properly. Is there anything specific I should be looking at to track down this issue?

gstefancyk · ‎12-02-2016

Splunk is running as local system.

gstefancyk · ‎11-30-2016

Looking in splunkd logs I have found my issue but I am not sure why I am running into these permissions issues.. 11-30-2016 16:11:03.548 -0500 ERROR Archiver - Failed to open file="C:\Program Files\Splunk\etc\deployment-apps\sendtoindexer\local\outputs.conf": Access is denied. I have fixed this issue by adding SYSTEM to have full control of the file, but moving forward how do I prevent this when creating additional files?

gstefancyk · ‎11-30-2016

I have created a "sendtoindexer" app following Splunk App for Windows Infrastructure 1.4 documentation and I cannot seem to get the outputs.conf file to push down to the deployment client. The app is showing as installed from the deployment server but I do not see any outputs.conf file on the deployment client. The rest of the folders and files of the app exist on the client but no outputs.conf. I have restarted Splunk services on the deployment client, reloaded the deployment server, and restarted Splunk on the deployment server but outputs.conf will not push down to the deployment client. Thanks in advance.

gstefancyk · ‎10-25-2016

Thanks rich7177. I must have missed that little section at the bottom of the App details page that says log everything to "checkpoint". I have configured the opsec lea add on to log to index checkpoint and data is now populating the Splunk App for Check Point.

gstefancyk · ‎10-25-2016

I am currently pulling logs from my Check Point Management station successfully and can search on them with no issues. I am trying to get the Splunk app for Check Point to display data and am looking for some clarification on what indexes need to be created? Currently I have all Check Point non-audit logs going into the default index. Can anyone clarify for me what index the Splunk App for Check Point looks at and what index or indexes I need to create?

Posts	19
Solutions	2
Karma Given	0
Karma Received	4
Member Since	‎10-25-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk Add-on for Check Point OPSEC LEA | 5.0.0 | ...

Splunk Add On For ServiceNow 5.0 | snow_incident.p...

Splunk add-on for Check Point OPSEC LEA: Change HO...

Alert when both devices in HA pair stop reporting

One Distributed Search Head Constantly Returning N...

Splunk App for Windows Infrastructure: Created "se...

Splunk App for Check Point

Splunk Add-on for Check Point OPSEC LEA | 5.0.0 | ...

Re: Splunk Add On For ServiceNow 5.0 | snow_incide...

Re: Splunk Add On For ServiceNow 5.0 | snow_incide...

Re: Splunk Add On For ServiceNow 5.0 | snow_incide...

Splunk Add On For ServiceNow 5.0 | snow_incident.p...

Re: How do I install the Splunk App for Secret Ser...

Re: Splunk add-on for Check Point OPSEC LEA: Chang...

Splunk add-on for Check Point OPSEC LEA: Change HO...

Re: Alert when both devices in HA pair stop report...

Re: Alert when both devices in HA pair stop report...

Alert when both devices in HA pair stop reporting

Re: Problem with alert-triggered scripts for Servi...

Re: One Distributed Search Head Constantly Returni...

One Distributed Search Head Constantly Returning N...

Re: Splunk App for Windows Infrastructure: Created...

Re: Splunk App for Windows Infrastructure: Created...

Splunk App for Windows Infrastructure: Created "se...

Re: Splunk App for Check Point

Splunk App for Check Point