A dirty solution I found is to do this <base_search> |bin span=1s _time |stats count by _time dest|eval startime=_time |eval endtime=startime+60 |eval threshold=100 |map search="search earliest=$startime$ latest=$endtime$ <base_search> dest=$dest$ |stats count by dest |where count > $threshold$" but this is really bad as it will trigger hundreds of searches (however many the base search returns). it improves a bit if I increase the span, but if its too high then its the same problem all over again. ... View more

I am facing a similar challenge above, ie  to find  firewall denies to same destination in a rolling 1 minute window which exceeds a threshold (eg 100). example below should generate an alert  00:00:00-00:00:30 - 10 denies 00:00:31-00:01:00 - 70 denies 00:01:01-00:01:30 - 50 denies 00:01:31-00:02:00 - 20 denies Since the deny count for time span span from 00:00:31 - 00:01:30 is 120. Using the traditional |bin span=1m, this does not generate an alert since each minute bucket (00:00, 00:01, 00:02) does not exceed the threshold.    There is an "aligntime" option in |bin, but that requires a relative time/epoch time, so that does not work either (may be possible if we can set it to the _time value for when an event is first observed.) I also explored using |streamstats with a time_window option, however that does not work either since the counter resets when the dest changes, so if the total failures per dest is interleaved with other denies, then it will not fire an alert either.  Hopefully someone has found a solution out there. ... View more

Putting these links here as they helped me greatly in creating a search to meet the question raised by OP. https://conf.splunk.com/files/2017/recordings/advanced-splunk-searching-for-security-hunting-and-alerting.mp4 Accompanying slides https://conf.splunk.com/files/2017/slides/advanced-splunk-searching-for-security-hunting-and-alerting.pdf Note that you just have to reverse the success / failure logic since the video used multiple successes followed by failure as an example. ... View more

Posting here on what worked for me. In looking at https://wiki.python.org/moin/WebServices  1. ran pip2 install --user suds  as the splunk user. 2. afterwards, copy ~/.local/lib/python2.7/site-packages/suds/ to $splunk_home/etc/apps/<my_app>/bin 3. if I now run a python script under $splunk_home/etc/apps/<my_app>/bin using the built in splunk python (ie /opt/splunk/bin/splunk cmd python), I can run these commands >>> from suds.client import Client >>> client=Client("http://www.dneonline.com/calculator.asmx?WSDL") >>> print client Suds ( https://fedorahosted.org/suds/ ) version: 0.4 GA build: R699-20100913 Service ( Calculator ) tns="http://tempuri.org/" Prefixes (0) Ports (2): (CalculatorSoap) Methods (4): Add(xs:int intA, xs:int intB, ) Divide(xs:int intA, xs:int intB, ) Multiply(xs:int intA, xs:int intB, ) Subtract(xs:int intA, xs:int intB, ) Types (0): (CalculatorSoap12) Methods (4): Add(xs:int intA, xs:int intB, ) Divide(xs:int intA, xs:int intB, ) Multiply(xs:int intA, xs:int intB, ) Subtract(xs:int intA, xs:int intB, ) Types (0): >>> client.service.Add(5,6) 11 I could not get this to work with zeep though. ... View more

Try this endpoint: http://docs.splunk.com/Documentation/Splunk/7.0.2/RESTREF/RESTsystem#server.2Fcontrol.2Frestart_webui using the code from the above TA >>> target="server/control/restart_webui" >>> response, content = rest.simpleRequest(target, sessionKey=sessionKey, method='POST') >>> response {'expires': 'Thu, 26 Oct 1978 00:00:00 GMT', 'date': 'Wed, 07 Feb 2018 03:51:03 GMT', 'cache-control': 'no-store, no-cache, must-revalidate, max-age=0', 'content-type': 'text/xml; charset=UTF-8', 'x-frame-options': 'SAMEORIGIN', 'server': 'Splunkd', 'status': '200', 'x-content-type-options': 'nosniff', 'content-length': '2174', 'connection': 'Close', 'vary': 'Authorization'} This does achieve the desired result of refreshing static content, though it does restart the UI which will impact users. ... View more

Updating this thread with as I had the same issue. There was a large csv file located in the lookup folder in one of my apps, which was causing the replication bundle to balloon. Removing this file resolved the issue. ... View more

I had a similiar issue- Found this thread to be helpful ... View more

Spoke with Splunk and got the answer. To add permission for a specific entry within searchbnf, add [searchbnf/<command stanza header in searchbnf.conf>] export=system to metadata\local.meta To add permission for all searchbnf commands, add [searchbnf] export=system to metadata\local.meta ... View more

Have this same issue as well. Using splunk btool searchbnf list --debug I do see that the app specific searchbnf stanzas are processed, though in search it does not show. It does work if I copy searchbnf.conf to etc\app\search\local so believe it is an configuration permission that needs to be applied via app specific local.meta, but cannot find information on how to define the config. In the GUI I do not see this defined as a config object within the context of the app. ... View more