Hi All, I'm trying to create a custom setup.xml for the app which I'm developing. After writing the setup.xml, restmap.xml, myconfig_parser.py file, I'm not able to see my custom xml as part of "https://XX.XX.XX.XX:8089/services" itself. Can someone please check and verify if I have provided all the right inputs and tell me if there is anything wrong in the code? API.conf [setupentity] server = 1.2.3.4 ise_username = admin ise_password = password restmap.conf [admin:myendpoint] match=/myisecustom members=isecustomendpoint [admin_external:isecustomendpoint] handlertype = python handlerfile = ise_python_handler.py handleractions = list, edit setup,xml <setup> <block title="ISE Active Session Setup" endpoint="myisecustom/isecustomendpoint" entity="setupentity"> <input field="server"> <label>IP Address </label> <type>text</type> </input> <input field="ise_username"> <label>UserName</label> <type>text</type> </input> <input field="ise_password"> <label>Password</label> <type>password</type> </input> </block> </setup> ise_python_handler.py import splunk.admin as admin import splunk.entity as entity import os class Config(admin.MConfigHandler): def setup(self): if self.requestedAction == admin.ACTION_EDIT: for arg in ['server', 'ise_username', 'ise_password']: self.supportedArgs.addOptArg(arg) def handleList(self, confInfo): confDict = self.readConf('ISE') #if None != confDict: # for stanza, settings in confDict.items(): # for key, val in settings.items(): # confInfo[stanza].append(key, val) # confInfo[stanza].append('changed', '1') def handleEdit(self, confInfo): name = self.callerArgs.id args = self.callerArgs if self.callerArgs.data['server'][0] in [None, '']: self.callerArgs.data['server'][0] = '' if self.callerArgs.data['ise_username'][0] in [None, '']: self.callerArgs.data['ise_username'][0] = '' if self.callerArgs.data['ise_password'][0] in [None, '']: self.callerArgs.data['ise_password'][0] = '' self.writeConf('ISE' , 'setupentity', self.callerArgs.data) # initialize the handler admin.init(Config, admin.CONTEXT_NONE) ... View more

What is the max number of Cisco IPS devices/sensors we can add? I have added 40+ devices, and system became bit slow. Can we know which thread IPS sensor/Device thread is consuming more resources? What is the Max log storage supported per Cisco IPS device? ... View more

Hi All, I have the following search query as a drilldown as part of the Simple XML Dashboard. <drilldown> <link> /app/cms-fortiweb/flashtimeline?q=`fortiweb_attack` earliest=-30d@d latest=now | search policy="$row.Policy Violations" </link> </drilldown> I have the same drilldown added for two panels. One panel has the visualization as Table and other other as Pie chart. So when i click on the Table to drilldown from my Dashboard, the drill down works fine by substituting the row value. But the same does not work when i try to drilldown from a PIE Chart. What could be the mistake here. Please provide your thoughts on this. ... View more

Hi All, I have the following search queries with me. index=XXX CISE_Failed_Attempts | timechart span=30m count by CISE_Failed_Attempts | rename NULL as "Failed Authentication Count" index=XXX CISE_Passed_Authentications | timechart span=30m count by CISE_Passed_Authentications | rename NULL as "Passed Authentications Count" Is there a way where i could combine both the queries together into a single query like the following index=XXX CISE_Passed_Authentications OR CISE_Failed_Attempts | timechart span=30m count by CISE_Passed_Authentications , CISE_Failed_Attempts Individually the search queries work fine. But when i try to do a timechart with two fields it fails. Please suggest a way to overcome this issue. ... View more

Context: Deploying apps via Deployment Server I have a deployment server where I have three splunk instances connected to it. All the apps which I have developed does not have the “local” folder shipped as part of it. Questions: 1) Whenever I copy the apps into the “deployment-apps” folder and do a splunk restart , I see that a folder called “local” automatically gets generated.Why is this getting generated.? 2) I see that the local folder is getting overwritten whenever I push apps via the deployment server. a. I hope it should not the case. If so , we will end up losing all the data customized in the splunk instance. b. Actually several of our users create artifacts on the local folder of app on the deployment client. But this gets overwritten everytime. Should not the “local” be persisted ? ... View more

Hi All, Recently i download the "Splunk for F5 Access" app and installed into into my Splunk Box. Whenever i restart the splunk process I see the following Configuration Warning Checking filesystem compatibility... Done Possible typo in stanza [firepass_log] in /home/splunk/etc/apps/firepass/default/props.conf, line 6: TRANSFORM = firepass-host There might be typos in your conf files. For more information, run 'splunk btool check --debug' Checking conf files for typos... Done All preliminary checks passed. Content of Props.conf: [firepass_log] KV_MODE = none TIME_FORMAT = %b%d%H:%M:%S TRANSFORM = firepass_host REPORT-sid = firepass-host,firepass_term_host_prt,firepass_login_src,firepass_failed_valid,firepass_failed_invalid,firepass_sid_full,firepass_sid_full_condensed,firepass_sid,firepass_sid_kv,firepass_access_type,firepass_remote,firepass_intrusion,firepass_app_tunnel_remote_host,firepass_user_domain,firepass_logon_denied Transforms.conf [firepass_host] DEST_KEY = MetaData:Host REGEX = (\d+\.\d+.\d+.\d+) FORMAT = host::$1 Can someone please help me here to find whats the issue is ? ... View more

Hi All, I have a requirement where i have around 80 saved searches which needs to run in an interval of every 5 min. Scheduling all the 80 saved searches to run at the same moment will be an issue and it will hog the CPU also. So i planned to run all the 80 queries in a batched way like.. For Example : 20 seaches at 1st min , another 20 at 2nd min etc... So that i will cover all the 80 searches in the 5 min window. Using the Splunk Cron "* * * * *" I see only option to provide only at the minutes level. Like schedule to run for every 5 min? How can i achieve it to run all in the 5 min window but , 1 min 20 , 2min 20 etc.. Please suggest. Thanks Prasanna Kumar ... View more

Hi All, I have a set of saved searches which i have scheduled for run for every 15 min interval. Each of the saved search triggers a script. By Default , the expiry time of the saved search which triggers a script is 10 min. But i want to set the expiry time of these saved searches as 1 hr and this setting needs to be set as global. So if the logged user creates the saved search from any app, the expiry time should be set as 1 hr. I already created a alert_actions.conf file in the app which i have created and set the following [script] ttl = 3600 Setting this will make it only available for that specific app. How can i make it a global setting? Please share your thoughts and suggestions. ... View more

Hi All, I have a very basic doubt with respect to all the *.conf files. I have transforms.conf , props.conf and alert_actions.conf file in which I have some config written. But all these *.conf files are part of an App which i have created myself. I know by default we can do all the changes and store it in ~splunk/etc/system/local. But i want to do all the customizations and ship it as part of an App which i have developed and it should be global. All your inputs are welcome. ... View more

Hi All, I have the following requirement: I have three users with the same permissions. Each user has been provided permission only to access his own created Index. For Example: User 1 --> Index 1 User 2 --> Index 2 User 3 --> Index 3 I have a dashboard created which has some search queries which is common for all the logged in users. When user1 schedules a dashboard report , the "sendemail.py" script gets triggered generating the PDF. I need to append the user name on which user has scheduled to run the report, to the file name of the pdf which gets generated. I know that authorize.conf is a file which stores all the user's details on providing which user has access to which indexes and other details. I need the user who has scheduled the report so that , if i know the user name i can access authorize.conf file and get other details also about that user. Please help me on how i can achieve the same. ... View more