About mbjerkeland_spl

mbjerkeland_spl

I just submitted a pull request to the original add-on with the changes you highlighted. I am hoping the original author includes it and gets a new version uploaded to Splunkbase. https://github.com/pdoconnell/TA-microsoft-windefender/pull/4

mbjerkeland_spl · ‎06-02-2020

After a bit of troubleshooting where we first thought the issue was with missing role permissions in Splunk, it turned out the KV Store was not running due to an expired certificate. We recreated the certificate using the splunk createssl command, restarted and voila, the Create Output Group button reappeared.

mbjerkeland_spl · ‎04-27-2020

This has been filed as a bug and is slated to be fixed in 8.0.4, according to SPL-183467. Splunk UF should use the python in your PATH.

mbjerkeland_spl · ‎01-23-2020

Hi, I'm the author of the App. Not sure why you are having issues with the dashboards, but this part indicates you have made local customizations to the App: | lookup dnslookup clientip as src_ip | top clienthost as the original app does not have this query. You may also try to clear any client side caches if you recently upgraded to Splunk 8.

mbjerkeland_spl · ‎01-20-2020

You're welcome. You should be able to filter out users in the base search as well as in the end of the SPL using | search . Can you paste the exact search you are trying as well as a screenshot of your data and possibly also the fields returned?

mbjerkeland_spl · ‎01-20-2020

Hi I suspect something as simple as this could work: sourcetype=cisco:asa tag=authentication tag=privileged | stats dc(host) as dc_host values(host) as values_host BY user | where dc_host > 1 You may need to refine the base search a bit and add additional BY clauses to get your desired result. I am on a cellphone so I am not able to test it myself unfortunately.

mbjerkeland_spl · ‎10-14-2019

Add the index name as index=something to the stanza called cisco_ios You will see that one referenced in the other stanzas

mbjerkeland_spl · ‎10-11-2019

There is a base eventtype you can adapt in the app. I believe it is the first one in eventtypes.conf. Just add your index name to that macro. A different approach would be to change your roles to automatically search that index by default.

Posts	8
Solutions	1
Karma Given	2
Karma Received	1
Member Since	‎08-22-2019

Online Status	Offline
Date Last Visited	3 weeks ago

Re: No CIM aligned fields for TA-WIndows-Defender

Re: CEF app, Create output group button missing in...

Re: Python 3 modular input on a universal forwarde...

Re: Cisco Networks App - no results found, open in...

Re: Search to alert user is logged into more than ...

Re: Search to alert user is logged into more than ...

Re: Cisco IOS and TA not showing data in dashboard...

Re: Cisco IOS and TA not showing data in dashboard...