Have you gotten any further ahead in this initiive? I am looking to build a dashboard for statistics on complianceto patching requirements, and perhaps confirm machines known by SCCM vs. our actual numbers. Any help greatly appreciated. ... View more

Greetings; I've just installed the TA and app in my Search Head Cluster/Indexer Cluster environment, and am extremely amazed at the level of reporting the app provides out of the box. I've gotten everything working, except for the "Usage Calendar". I've run the rebuild of the lookup for usage calendar under help, but it comes back with no results found. My TemplateForXenDesktop7/lookups/calendar_users.csv file is empty, and writable. Any recommendations? Thank you, -mike ... View more

Your sourcetype and add-on on indexers are as I suggested? ... View more

I do not believe these are fields that come with this app; they do not exist on my deployment, nor was I able to find "Applications_Name" anywhere in my servers. I suspect these fields may have been locally grown, I suggest looking up their attributes/owner under field settings. ... View more

Here are some hopefully simpler instructions (this worked for me): On your windows management server, install UF, and the Splunk add-on: https://splunkbase.splunk.com/app/2772/ On your syslog hvy/uf, add the syslog-TA: https://splunkbase.splunk.com/app/3121/ On that same syslog host, in your inputs.conf, add this: (not the same as the sourcetype you've used) [monitor:///syslog-servers-logslocation/.log] index = sep **sourcetype = symantec:ep:syslog* disabled = 0 My indexers have: https://splunkbase.splunk.com/app/2772/ My search heads have the app: https://splunkbase.splunk.com/app/1365/ as well as https://splunkbase.splunk.com/app/2772/ HTH, please keep me posted. -mi ... View more

Hello; I am already collecting and forwarding all logs from my servers into WEC, WEC then whitelisting and resending into Splunk only the Security Events ID's I am interested in. I would like to additionally resend into Splunk a "whitelisted" "System" logs, but only for "error" and "critical"; i.e., not EventID based as I am not sure what they are, plus do not wish to index informational garbage. Does anyone know how to white-list based on level vs. ID? Thank you in advance, -mi ... View more

Greetings! I am running the latest Splunk Add-on for Citrix NetScaler, and ingesting data from Netscalers with V11 and V10.5 devices. My V11 netscalers are properly showing all fields, while those with V10.5 are not. I am receiving data via syslog-NG with a UF installed, and my environment is a SH and index clustered. I would like to have fields available for all devices, any suggestions to achieve this? Thank you, -mi ... View more

You can narrow down your search by selecting any of the fields on the left column, then selecting any of these, i.e. src_ip, etc. Look at the Cisco ASA app, has some pretty good searches built-in. ... View more

You stated you setup syslog-ng on your UF, the .conf is usually in either /etc or /use/local/etc, run a find run this: netstat -tulpn The above will show ports open, and by which process. Need to determine if udp 514 is open by Splunk or syslogng ... View more

For starters, you cannot run syslog-NG and have your UF listening on udp 514, that will cause a conflict. Either stop//disable syslog-NG, or stop the UF from listening on that port; your choice, but not both. On your inputs on your UF, you will need to point to the file that syslog-NG creates and fills, or, if you chose to listen to udp/514 on the UF, then do nothing. I see you have either given up, or about to give up, on syslog-NG, not a good choice. I offered to review your syslog-ng.conf, but you never posted that. ... View more

Is this still an issue? ... View more

This site totally mangled my suggestion, but now that I know your interface name, it is this from your syslog-NG server: tcpdump -vvv -i ens160 udp port 514 If you see data coming from your ASA firewall, then your problem is with your syslog=NG config, which I've asked you to post, but you did not. As I've said before, I suspect your issue is most likely with your syslog server, given setting up an ASA to send to syslog is pretty straight-forward. Another root cause might be how you've setup or used DNS, see last line in his comment. Based on your output, I am guessing the following: indexer is 10.10.50.11 your universal forwarder/syslog server is 10.10.50.11 ASA Firewall is 10.10.50.1 Correct? Did you configure each of these to communicate using hostnames, or IP addresses? I ask because your tcpdump is showing attempts to resolve internal IP addresses, which will not, should not work. Check that you ASA is sending to an IP address, not a hostname. Check that your syslog-NG server, which is running your UF, is sending (output.conf) to your indexer using an IP address, not a hostname. ... View more

Try this: Run traceroute on your ubu box to first determine if you are getting data from your ASA: tcpdump -vvv -i src host and udp port 514 or tcpdump -vvv -i src host and tcp port 514 Assuming you see data, then move on to the next steps, else you are either not sending logs from your ASA, you have a routing issue (which I doubt as you are able to ping your syslog server), or are perhaps running SELinux and are blocked? If you see data, then your issues are with either your syslog-NG daemon, or its config, most likely its config. You need to have syslog listening on the appropriate protocol, dependent on whether you are sending to tcp or udp; you can listen on both for syslog-NG. Also, aside from a listener, you must objects such as source, destination, log, filter, parser, rewrite rule, or template. If you see data in tcpdump, then copy/paste your syslog-NG config file into this issue, please remove your comments. ... View more

My thoughts exactly, but my Service Now in house SME states that the Service Now Security Operations app requires a Service Now add on we do not have. Looking for feedback on what Service Now side apps the Splunk app requires. ... View more

I am looking for differences between ServiceNow Security Operations and the Splunk App for ServiceNow Both of these allow creation of new tickets, the second one above seems to a lot of work to implement, the first I "believe" requires a Snow add on, not sure ... View more

App does not report virus at all ... View more

I guess I will be testing for you 😉 Any suggestions for how to alter or setup use of a proxy for reaching SF? ... View more

I was unable to install on my search head cluster, installed instead on a heavy forwarder; I do not anticipate issues, do you? Also, I need to configure access to SF via a proxy, I recall somewhere, not sure if it was for this app, a how to for modifying the python scripts to traverse to SF via a proxy. Can you assist? TY ... View more

App is now downloadable and available for on-prem Splunk. I am testing it now, need to get it to work through a proxy and SHC. ... View more

FYI App is now downloadable and available for on-prem Splunk. I am testing it now, need to get it to work through a proxy and SHC. ... View more

Elias; The online documentation still refers to Splunk Cloud, step 2. I assume I can safely ignore this step for on-prem Splunk? Thank you. ... View more

Great news, thank you Elias! Just in time for my own deployment. I am running on a SHC across multi site idx's, anything to look out for? ... View more

Nope, required Cloud... ... View more