Here is the python script. import re,collections,json,csv,sys,urllib,urllib2 import requests import shutil,time,os import splunk.entity as entity import splunk.Intersplunk import argparse def sitereview(url,proxy,port,username,password): httpproxy = "{0}:{1}@{2}:{3}".format(username,password,proxy,port) proxy_handler = urllib2.ProxyHandler({'http': httpproxy}) opener = urllib2.build_opener(proxy_handler) urllib2.install_opener(opener) baseurl = 'http://xxx/rest/categorization' query_args = {'url': url} data = urllib.urlencode(query_args) headers = {'User-Agent':'Mozilla 5.10'} request = urllib2.Request(baseurl, data, headers) response = urllib2.urlopen(request) json = response.read() return json def getCredentials(sessionKey):## added for getting the credentials myapp = 'abc-app' try: #list all credentials entities = entity.getEntities("storage/passwords", namespace = myapp, owner = 'nobody', sessionKey = sessionKey) except Exception, e: raise Exception("Could not get %s credentials from splunk. Error: %s" %(myapp, str(e))) for i, c in entities.items(): return c['username'], c['clear_password'] raise Exception("No credentials have been found") def main(): databasefile = "localcat.txt" date = time.strftime("%Y%m%d") newfile = databasefile +"_"+ date shutil.copyfile(databasefile, newfile) os.remove(databasefile) destination = open(databasefile, "w") source = open(newfile, "r") proxy = 'PROXY' port = '80' #username = 'USERNAME' #password = 'PASSWORD' ## added for getting the credential from the sessionkey results, unused1, settings = splunk.Intersplunk.getOrganizedResults() sessionKey = settings['sessionKey'] if len(sessionKey) == 0: sys.stderr.write("Did not receive a session key from splunkd.") sys.exit(0) username, password = getCredentials(sessionKey) for line in source: time.sleep(10) if 'define category test_Incident' in line: destination.write(line) elif 'end' in line: destination.write(line) else: result_json = sitereview(line,proxy,port,username,password) parsed_json = json.loads(result_json) unrated = str(parsed_json['unrated']) if unrated.lower() == 'true': destination.write(line) source.close() destination.close() main() ... View more

Hi, Thanks for the suggestion. Are you able to elaborate the steps/any example for suggestion #2? What do you mean pointing the script to something other than the default? (2) if the script is properly returning a 1 which is not an error, then point the script at something other than the default. Thank you. ... View more

@LukeMurphey, I tried the ES' REST API but it seems that it can only be used to edit only the default field: status, urgency, owner, and comments. Anyway to edit the value of new field that I created from Splunk ES > Configure> Incident Management > Incident Review settings. The objective is: I created a new field 'incident category' for each notable event in the incident review. The security analyst can assign and edit the category after their investigation. The incident category are pre-defined list (malware, dos, human mistake, and false +). appreciate your advice. ... View more

Hi, Thanks for the help! ... View more

Hi, Thank you. I have read this, however I can only filter based on the the field available in the form e.g. status IR - In Progress My objective is to filter based on the 'notable event name' e.g. notable event windows_xxx in the dashboard and linux_xxxx in the other dashboard. can it be done using name/search? since, there is a name and search textbox in the original dahsboard to perform filter. if can be done, can you share the field name for that? thanks ... View more

Hello, How about to get daily dynamic lookup from UBA containing high-risk user? is it possible? thanks again ... View more

Hi, I used the same approach but I received this error command="remedyincidentcreate", Failed to get conf=remedy, stanza=remedy_account, status=401, reason=Unauthorized, detail= call not properly authenticated I have set the passauth = true and insert the following in my script import sys import splunk.Intersplunk as si def main(): results,dummyresults,settings = si.getOrganizedResults() handler = RemedyIncidentCreateManual() handler.handle() Any help is appreciated. ... View more

Hi, Is there any pre-req in order to use the above script? I inserted to my .py and return error code 1. ... View more

Hi, For item number 2, are you referring to following steps: To install an add-on to an indexer: 1. Download the add-on from Splunkbase, then unpack the .tgz package. 2. Place the resulting Splunk_TA_ folder in the $SPLUNK_HOME/etc/apps directory on your indexer. 3. Restart the indexer. Have you performed this? What would be the name of the default indexes created? Thanks ... View more