Over a decade later but here is my RPI info and which forwarder worked on it: @raspberrypi:/opt# uname -a Linux raspberrypi 6.1.53-v8+ #1680 SMP PREEMPT Wed Sep 13 18:09:06 BST 2023 aarch64 GNU/Linux From previous releases page: Splunk Universal Forwarder 8.1.9 / ARMv6 / 2.6+, 3.x+, 4.x+, or 5.x+ kernel Linux distributions 32-bit ... View more

. ... View more

Still no one has answers for this ? I guess it's not in this viz's roadmap ? ... View more

What are cyber threats to Splunk network ports. Can someone tell ... View more

Hi, is there an equivalent solution for splunklib? ... View more

  index=_audit sourcetype=audittrail action IN ("login attempt" logout) | table _time host user info reason clientip method session​     If you add a filter on the user field you can narrow down to specific account. - clientip: source IP of connection, obviously NAT could hide the source but that's up to your network layout - session: this is the http auth token that other users have already shown how to force delete from the system ... View more

@phoenixdigital what is the "self" object you are referring to here? I'm having issues getting session key in a scripted input running on windows, but it works in linux environments. Best regarss ... View more

Good to see modbus has been added to Splunk Streams 8.0  https://docs.splunk.com/Documentation/StreamApp/8.0.0/ReleaseNotes/NewFeatures The customers I've worked with wanted to probe endpoints so I've ended up writing my own modular input. We've also moved to Claroty for security monitoring of modbus data travelling through the network. Claroty can feed Splunk with richer alerts and analysis of "normal" traffic. Had this been in Streams a few years ago prior to using Claroty I would have had a field day.   ... View more

Hey There, i want to push this threat and ask if somethings changed since 2016?  I have the same question, need to delete and post data to a KV store and do not want to grand Admin level permissions to a user just for that.  ... View more

Apologies for my ignorance.  I've having a similar issue. Regarding this comment: "This however did not appear to work. Adding the props.conf and transforms.conf files to the indexer worked however." Exactly how do you add these files to the indexer? ... View more

So i've used the example you provided and created a binx app using the following and mine works. inputs.conf [monitor://C:\program files\splunk\etc\apps\binx\spool\*] disabled = 0 followTail = 0 host = myhost index = binx sourcetype = binx_binary props.conf [source::....binx] invalid_cause = archive unarchive_cmd = binx.pl I don't have any sourcetype for binx_binary in my props.conf or NO_BINARY_CHECK ... View more

Granted I can see why it would be a safe guaranteed way to stop a imposter forwarder from sending in data. That said though it appears Splunk is completely ignoring the requireClientCert because even when I set it to false it still doesn't work. ... View more

Yeah there is still confusion amongst some of our engineers (and splunk support) who are convinced server.conf settings can affect the port 8000. We are not sure which is right yet. Notably things like cipherSuite, sslVersions and sslVersionsForClient. Thanks for the tip. I forgot you could add images directly (fixed it up) ... View more

My guess would be that Splunk will keep track of the position where it last was in the file like any other input monitor. Please provide some feedback on this topic. cheers, MuS ... View more

very cool, glad i could help! ... View more

Come back and pick an answer and click Accept to close the question and award your bounty! ... View more

Edit: Actually this did not work. My original question still stands. Disregard I RTFM!!!! I can define a host in the jmxserver definition and it doesn't impact anything but returns the correct host. inputs.conf [jmx://Combined system information] config_file = config-combined.xml hec_batch_mode = 0 hec_https = 0 index = jmx output_type = stdout polling_frequency = 300 sourcetype = theSystem:jmx config-combined.xml <jmxserver host="myjmx01" jmxServiceURL="service:jmx:remoting-jmx://myjmx01.mydomain.com:9999" jvmDescription="myjmx01 JMX Data" jmxuser="SplunkAccessUser" jmxpass="xxxxxxxxxxxxx"> <mbean domain="com.xxxxxxxx" properties="type=web,name=com.xxxxxxxx.RequestorManagement,id=*"> <operation name="RequestorList" outputname="RequestorList" /> </mbean> </jmxserver> <jmxserver host="myjmx02" jmxServiceURL="service:jmx:remoting-jmx://myjmx02.mydomain.com:9999" jvmDescription="myjmx02 JMX Data" jmxuser="SplunkAccessUser" jmxpass="xxxxxxxxxxxxx"> <mbean domain="com.xxxxxxxx" properties="type=web,name=com.xxxxxx.RequestorManagement,id=*"> <operation name="RequestorList" outputname="RequestorList" /> </mbean> </jmxserver> ... View more

That resolves it for modular inputs thank you. It doesn't appear to help with custom setup handlers though. 01-23-2017 08:12:45.396 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py setup': INFO myapp=1,type=setup,starting 01-23-2017 08:12:44.788 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py setup': INFO myapp=1,type=setup,starting From this custom endpoint http://pastebin.com/2zMM8sak ... View more

Thanks for the info I have that in my configuration an excluded it from my example because that part worked. Unfortunately there are a few issues with this method. This only ever allows you to set it once. If you try to update the username/password it will return an error. Also when I go to use this stored password from another modular input I need to know the username when calling the REST interface. So I have a few choices here. I hardcode in the username into the python code for the modular input which sort of defeats the purpose of having a setup page. I'm going down the route of making a custom endpoint which will do the following Store the username and proxy server address in a custom.conf Update/create the password credentials directly via the REST interface as opposed to relying on the method in online examples. I do wish there was an easy way to debug custom endpoints because the current errors that are returned from Splunk are utterly useless. http://imgur.com/a/basRS index=_internal sourcetype=splunkd also contains nothing useful 01-19-2017 10:32:42.492 +1000 ERROR AdminManagerExternal - <class 'splunk.admin.UsageException'>: Received no serialized data via stdin (mode: setup). Will not continue. ... View more

I am glad it could be at least somewhat useful to you even if it is not the complete answer you are looking for. ... View more

You're welcome! we're fixing this issue in the upcoming 6.6.1 maintenance release (should be available later this week or early next week) ... View more

Nice that all makes sense I appreciate the discussion. When I get the time I will write a script to generate logs so I can see this loss/gap in action. It is not that I don't believe you I just want to see it happening with my own eyes 🙂 As you said it is a tiny fraction of a loss but it is good to know that the file monitoring does actually pause processing the log until the UF queues are "unblocked". That was my major concern. It would be great if this was covered clearly in the documentation though. They talk about buffers for the tcp and scripted inputs but nothing is said about the other "types" of inputs. Thanks again. ... View more

You could create app package on command line with command: splunk package app and then it tell to you where you could found and copy .spl file to transfer it to e.g. Deployer. ... View more

@chasrini If you haven't found your answer elsewhere in Splunk Answer, please put in a question that stands on its own. ... View more