I've dealt with ES in an air-gapped environment. The problem is that you'll need threat intelligence feeds in later stages of the project to correlate your event with Indicators of Compromise (IOCs). You could use it without, of course, but this would mean you'll be missing quite some valuable information.   Another way could be, set-up an automated way of downlaoding threat intel feeds and putting them into CSV files which then can get ingested locally by the ES SH.     Skalli ... View more

Hey. Take a look at the corresponding docs page. You need a pem file with your certificate (and the issuing public CA in a chain) as well as the private key seperately. You can simply cut and paste the encrypted key to a new file.     Skalli ... View more

Hey. You might want to take a look into the TrackMe App. That's a powerful one as well.     Skalli ... View more

Unfortunately, it has not been fixed, not even on 3.3.1. ... View more

Hi,   all you need to know is available publicly in the docs. For your web server: this and this.     Skalli ... View more

Splunk is way too expensive to just use it as a syslog server. You'd rather want a Linux-based system that uses either rsyslog or syslog-ng which collects all logs for you. And the logs that you'll need then go into your Splunk environment. Another contra, besides the cost, is that Splunk may and will be restarted sometimes. The server that will listen for incoming syslog data will then not be able to receive that data while Splunk restarts. A syslog server itself won't be restarted regularly.   Skalli ... View more

Have you tried using the paramter   create_empty=true   in your outputlookup command?     Skalli ... View more

Can you show us your props.conf and transforms.conf stanzas for the according sourcetype? The _time seems to be extracted correctly. What does the Monitoring Console say? Any filled up queues in your environment? What's the load of the indexers? Any Heavy Forwarders in between? Skalli ... View more

Just wanted to let you know that ES 6.1.1 is considered stable now with Splunk Enterprise 8.0.3. 🙂 ... View more

Ah, now after posting my answer I found this one.. seems like I missed it. I'll convert my answer to a comment. It's enough to enable list_storage_passwords as the other capability can be improted from the user role. Skalli ... View more

Okay, that's strange. Can you try to manually create a notable event and see whether the notable event gets created? https://docs.splunk.com/Documentation/PCI/4.1.0/Install/Notableevents#Create_a_notable_event_from_an_existing_event What version of Core and ES are running? ... View more

Unfortunately not. The stable versions aren't available publicly. 😕 ... View more

Didn't see that one, good point 🙂 ... View more

Splunk 8 with ES 6.0 is not considered stable yet and I'd not advice to use those versions in production, yet. You might want to consider upgrading to Splunk Enterprise version 7.3.3 with ES 5.3.1 and go to 8.x and ES 6.x at a later point. Skalli ... View more

Which Splunk version? Did you create your own app configuration for this or are you using the server.conf specified under $SPLUNK_HOME/system/local/ ? In either case, I'd suggest to remove the configuration and try to add the peer again by running the CLI command and see if that works. Reference: described here in the docs. Skalli ... View more

Do you have the Monitoring Console enabled somewhere? Checked for skipped searches? ... View more

Backups are a good practice in case something goes wrong. It's correct that the tar will only overwrite configurations found in default and not local, but I would not suggest going without a backup of your $SPLUNK_HOME/etc directory. Skalli ... View more

Your correlation search needs to run an adaptive response called "Notable" which then will create a notable event with all the necessary information to write into the notable index. Did you check that your CS has the notable action enabled? Skalli ... View more

Hi, if you are developing apps for Splunk, you can request a developer license here for a broader feature set available. Splunk Lite doesn't allow you to use all features. Skalli ... View more