the file lastpass-log.py not located under bin path.  Even, trying to save the inputs but not showing in UI as it's saved. But in backend inputs.conf showing value saved. ... View more

Even I also open a case for this, but no resolution on this issue. ... View more

Did you complete DB-Connect configuration? This is the first change need to complete. ... View more

One thing is sure, without having SQL skill never try to rectify the error of these queries. 3 out of 5 is done but it was kind of brainstorming to make the correct query. Only sccm:malware and sccm:status_message are in progress. But really appreciate and thanks for sharing the queries, it helps us to choose the right table_name. ... View more

I have seen the link you are referring, but I really can't figure out the queries as not much experience on SQL. https://github.com/Ricapar/splunk-sccm/blob/master/default/inputs.conf It will be a great help if you can share the working queries over here. ... View more

I have already created a separate thread for the same. https://answers.splunk.com/answers/657104/sccm-queries-for-integration-with-splunk.html Anyways, thanks for showing the missing details on this question. Work was done so far: Successfully configure the DB-Connect on Splunk to read the entire SCCM-DB. SCCM version: 2012 R2 (Build : 1706) Splunk Version: 6.5.0 (on premise) ... View more

Forgot to add these details: Work was done so far: Successfully configure the DB-Connect on Splunk to read the entire SCCM-DB. SCCM Version: 2012 R2 Splunk Version: 6.5.0 (on premise) ... View more

I have MS-SCCM in my Customer Location and integrated with Splunk with the help of DB-Connect. Can anyone help with the queries for Client Status Messages, Client Software Inventory, Client Health and Client Endpoint Protection? ... View more

Hi, I tried with "SELECT dateadd(HOUR, 4, [EPOEvents].[ReceivedUTC]) as [timestamp]," but still is showing the difference with 4 hours. Can you help on this? ... View more

Hi, for me getting an error on 401 Client Error for Unauthorized URL. 2017-11-12 09:01:37,305 ERROR pid=21224 tid=MainThread file=base_modinput.py:log_error:307 | HTTP Request error: 401 Client Error: Unauthorized for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$format=json&orderby=Received%20asc&$filter=StartDate%20eq%20datetime'2017-11-09T09:31:45.118227Z'%20and%20EndDate%20eq%20datetime'2017-11-14T05:28:45.118271Z' I tried the above URL from the web, but I cannot login inside. Any details will be helpful. ... View more

For me also getting some kind of different error for both was_findings and knowledge_base. Any please or suggestion will be highly appreciate. Log source path is "ta_QualysCloudPlatform.log" under /opt/splunk/var/log/splunk. [was_findings] TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] DEBUG: TA-QualysCloudPlatform [knowledge_base] - Loading custom settings TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Start TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Start logging knowledgebase TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Outputting logs to stdout TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Making request: https://qualysapi.qualys.eu/api/2.0/fo/knowledge_base/vuln/ with params={'details': 'Basic', 'action': 'list'} TA-QualysCloudPlatform: 2017-10-15T10:12:16Z PID=9027 [MainThread] ERROR: TA-QualysCloudPlatform [knowledge_base] - Unsuccessful while calling API [403 : Forbidden]. Retrying: https://qualysapi.qualys.eu/api/2.0/fo/knowledge_base/vuln/ with params={'details': 'Basic', 'action': 'list'}. Retry count: 1 [knowledge_base] TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] DEBUG: TA-QualysCloudPlatform [was_findings] - Loading custom settings TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Start TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Start TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - WAS findings were last fetched on 1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Fetching WAS findings data for Hosts which were scanned after 1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Fetching all WAS detection data TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Running in single thread mode TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Making request: https://qualysapi.qualys.eu/qps/rest/3.0/search/was/finding with params=true1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - WAS detection fetched TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Parsing WAS detection XML TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - API Response Code = UNAUTHORIZED TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] DEBUG: TA-QualysCloudPlatform [was_findings] - Exception while parsing. API ERROR. Message=UNAUTHORIZED :: Traceback (most recent call last): TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] ERROR: TA-QualysCloudPlatform [was_findings] - could not load API response TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Done TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - was_findings run completed. Sleeping for 10800s ... View more

Hi Sridhar, is that Admin Guide of NSS can be available from NSS Admin UI or Zscaler UI. I don't have much information on it. Appreciate for your help in advance. ... View more

Can I get similar kind of thing for Windows Universal Forwarder remote installation. I mean, like very straight forward solution. ... View more

Even for me also, other 2 Search Head Cluster member showing the same status. last_conf_replication : Pending Any quick suggestion to fixed it. ... View more

One last understanding from you, hope you will help me out. When I start making search head instance into cluster mood, why most of the options vanish from settings. How can I keep all the options available intact after search head cluster inside setting. ... View more

Hi martin_mueller, Thanks for sharing the link. Based on that details, I configured the Deployer only up-to shclustering stanza. [shclustering] shcluster_label = new_cluster1 pass4SymmKey = $1$vZu7quK4ZPxUzEb7xd/1 Now my question are below: Do I need to still run the command on each instance of search head cluster splunk init shcluster-config -mgmt_uri https://SH1:8089 -replication_port 9200 -secret santabanta Do I need to still run the command assign one of the members as Captain and set the member list splunk bootstrap shcluster-captain -servers_list https://SH1:8089,https://SH2:8089,https://SH3:8089 Is it possible to push these two (question 1 and question 2) configuration from Deployer via apps. ... View more

Hi woodcock, Your logic worked. But could you please explain, what is the issue on my logic. Just want to avoid any problem on next time. ... View more

Hi mpreddy, Well, I am not sure whether I can get that logs or not. But possibility is ZERO. Let me try to get it. ... View more

Can you confirm, in your configuration indexes.conf is located under master-apps/_cluster/local/ ? Or you have put your indexes.conf under another app within master-app/your_app/local/ ? ... View more

Hi garethatiag, I didn't run /opt/splunk/bin/splunk btool indexes list --debug on cluster peer. But from GUI, I didn't see the index "test" on each cluster peer. Which means, the configuration is wrong ! ... View more