the file lastpass-log.py not located under bin path.  Even, trying to save the inputs but not showing in UI as it's saved. But in backend inputs.conf showing value saved. ... View more

If you have created the script file in windows you would get this error while running from Linux . Try creating the script file in Linux vi editor, paste the script and save . Alternatively you could run the following command for your script file to remove trailing \r character  sed -i 's/\r$//' filename ... View more

Even I also open a case for this, but no resolution on this issue. ... View more

Hello, Any details about the DBConnect setting between SPLUNK and SCCM-DB... We tried several jdbc but still no luck to use the Windows Authentication... jdbc:sqlserver://10.16.102.120:1433;databaseName=CM_UCT;InstanceName=Configmgr;Domain=adtest;   the splunk server is in another Domain AD...   Thanks, Dom   ... View more

Hi ,   The TIME_FORMAT you provided doesn't work for me. My timestamp in data looks like: 2020-07-02T18:00:18+02:00 with name log_modified_date. i have written below props.conf: [_json] INDEXED_EXTRACTIONS = json KV_MODE = none AUTO_KV_JSON = false NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = last_modified_date TIME_FORMAT = %Y-%m-%dT%H:%M:%S+%2N:%2N MAX_TIMESTAMP_LOOKAHEAD = 25     and getting time extracted as :  7/2/20 6:00:18.020 PM     I want the time field extracted in same way as in data with + value as well like:   7/2/20 6:00:18+02:00 PM    something like this Please let me know what i am doing wrong as i am not getting expected output. ... View more

Have a look at this app's tags.conf. Check out the tag combinations listed for each eventtype and compare to what is required for each CIM data model. It looks like this app tags events to match the following data models: Authentication, Network Traffic, Web, Data Loss Prevention, Intrusion Detection, Malware, Network Session, Network Resolution, and Performance. Before rebuilding every data model you might want to check the logs you're getting to see if every eventtype is being sent to Splunk and that the logs are being parsed/tagged properly. This app is tagging by eventtype. `[eventtype=Zscaler_DNS] dns = enabled network = enabled resolution = enabled [eventtype=Zscaler_CFW] communicate = enabled network = enabled [eventtype=Zscaler_Proxy_General] communicate = enabled end = enabled network = enabled performance = enabled proxy = enabled session = enabled start = enabled web = enabled [eventtype=Zscaler_Proxy_Malware] attack = enabled ids = enabled malware = enabled [eventtype=Zscaler_Proxy_DLP] dlp = enabled incident = enabled [eventtype=Zscaler_ZPA] authentication = enabled communicate = enabled end = enabled network = enabled performance = enabled session = enabled start = enabled vpn = enabled` The tags required for each data model are listed here http://docs.splunk.com/Documentation/CIM/4.11.0/User/Howtousethesereferencetables ... View more

I was also having this issue trying to get Audit.General logs. It turns out there is a python script packaged with the app that sets a time-delta threshold. I fixed this by lowering the threshold from the default 7 days (packaged with the app) to match our environment (which happens to be six days). The script is: bin/splunk_ta_o365/modinputs/management_activity.py. The line I had to change was: last_updated_time = datetime.utcfromtimestamp(now) - timedelta(days=7) Not the ideal solution, but it seems to work. I hope the next version of the app makes this a configurable parameter. ... View more

Yes, the timezone is set to Asia/Dubai, but still the data time is 4 hour less. ... View more

That's intentional, many settings should not be performed on one cluster member only. These should be deployed through the deployer to keep all cluster members in sync. To avoid breaking things, only settings that are safe to set through the UI are exposed by default. Relevant docs: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/HowconfigurationworksinSHC ... View more

You have not shown the raw data so my solution may be slightly overcomplicated, too. First of all, avoid join and transaction if at all possible, they have unescapable limits which means that they do not scale well at all. Most of the time stats can be used and it map/reduces so it is FAST. If you check the Job Inspector , you will see that my search is MUCH faster and it probably also returns more (accurate) results. My solution makes a single pass through the data and then a second pass to refine the intermediate results. The best way to learn is to strip of the last pipeline and see what each step does, and then do it again until you get to the point where you know what the remainder is doing. ... View more

Update: Based on the configurations you added to your question, you should be able to send data into the new index now. The index will not show up in Splunk Web until some events have been added to it. ... View more

Most of my index configuration is in the above location on the master. ... View more

Are you taking the online/eLearning Splunk Education courses for Admin or Power User? Clarification regarding the quizzes: If you're taking Splunk Education courses such as "Using Splunk" or "Searching and Reporting" via eLearning, eLearning is a self-paced online course with videos and labs for each module. After each module, there is an online quiz that you can take multiple times. The way the eLearning course works is that you have to complete each aspect of the course such as watching the videos, doing the labs, and completing the quizzes in order for Splunk to mark the course as completed so that it can count towards getting certified. If you're just reviewing the PDFs of each module, it may not be enough to prepare you for the exam. Regarding the certification exam: If you do not pass after 3 attempts, please email certification@splunk.com for retake options. If you have not taken the recommended courses, you will be required to do so before you can take the test again. If you are without a Splunk test instance, you should definitely download Splunk and do the Search Tutorial at least. Also, are a couple of previous Answers post to help you in getting started: - Hungry Newbie: Best way to learn Splunk - Training materials for new users Hope that helps. Good luck to you! ... View more

After checking, both the Indexer having same indexes. But still cant even figure out the inputs data. Any suggestion, where I am missing something. ... View more

Yes they will. ... View more

For me also getting some kind of different error for both was_findings and knowledge_base. Any please or suggestion will be highly appreciate. Log source path is "ta_QualysCloudPlatform.log" under /opt/splunk/var/log/splunk. [was_findings] TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] DEBUG: TA-QualysCloudPlatform [knowledge_base] - Loading custom settings TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Start TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Start logging knowledgebase TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Outputting logs to stdout TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Making request: https://qualysapi.qualys.eu/api/2.0/fo/knowledge_base/vuln/ with params={'details': 'Basic', 'action': 'list'} TA-QualysCloudPlatform: 2017-10-15T10:12:16Z PID=9027 [MainThread] ERROR: TA-QualysCloudPlatform [knowledge_base] - Unsuccessful while calling API [403 : Forbidden]. Retrying: https://qualysapi.qualys.eu/api/2.0/fo/knowledge_base/vuln/ with params={'details': 'Basic', 'action': 'list'}. Retry count: 1 [knowledge_base] TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] DEBUG: TA-QualysCloudPlatform [was_findings] - Loading custom settings TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Start TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Start TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - WAS findings were last fetched on 1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Fetching WAS findings data for Hosts which were scanned after 1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Fetching all WAS detection data TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Running in single thread mode TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Making request: https://qualysapi.qualys.eu/qps/rest/3.0/search/was/finding with params=true1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - WAS detection fetched TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Parsing WAS detection XML TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - API Response Code = UNAUTHORIZED TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] DEBUG: TA-QualysCloudPlatform [was_findings] - Exception while parsing. API ERROR. Message=UNAUTHORIZED :: Traceback (most recent call last): TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] ERROR: TA-QualysCloudPlatform [was_findings] - could not load API response TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Done TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - was_findings run completed. Sleeping for 10800s ... View more

Hi Daniel. No. The support is still talking to the development team. ... View more

If you are using DS, never put anything in $SPLUNK_HOME/etc/system/local because then it cannot be controlled (overridden) from the DS. Instead create a DeploymentClient app and then manually deploy this to your Deployment Clients the first time. This way you can hand individual clients (or classes of them) back and forth to different DS nodes (i.e. lab vs production) from each DS. The only gotcha is that you should NOT deploy to clustered Indexers or clustered Search Heads. ... View more

I downvoted this post because the nss config guide does not have configuration steps for the "zscaler app for splunk" it only demonstrates how to configure the nanolog streaming service to send logs via syslog in cim format. the documentation for this app is poor. ... View more