Hello, We have an issue where when we set up the alert action we put all the required fields with the red *. We trigger the alert and in the logs, we see that it is requiring the content: components. "fields": { "issuetype": { "name": "Task" }, "priority": { "name": "High" }, "summary": "Splunk Alert: Alert", "project": { "key": "id " }, "description": "The alert condition for ' Alert' was triggered." } }, **HTTP Error=400, content={"errorMessages":[],"errors":{"components":"Components is required."}}**" In custom fields we put a component and we triggered the alert and we got a different error : }, \"content\": {\"component\": { \"name\": \"Incidents"} } } }" **action_name="jira_service_desk" search_name="CrowdStrike Detection Alert" signature="Unexpected error: Expecting property name enclosed in double quotes: line 15 column 2 (char 257)."** Can you please Advise? Thanks! ... View more

Hello Folks, I am installing the Gigamon app on splunk and it requires the Splunk Stream app as well as the Add-on. I followed the instructions as provided in Readme file. When I restart the app I found this log : Failed to start streamfwd, the process will be terminated: Incompatible configuration file (run pupgrade.py): /opt/splunk/etc/apps/Splunk_TA_stream/default/vocabularies/gigamon.xml Stream App version : 7.2.0 Gigamon app Version : 1.2.1 I copied the latest xml file over her to the Stream app as well as the TA : 7.1.1 and still didn't work. gigamon_vocabulary_7.0.1.xml gigamon_vocabulary_7.1.0.xml gigamon_vocabulary_7.1.1.xml Do you guys know if there's a new xml file for the newest version of Stream ? Please any help is appreciated... ... View more

Hello Folks, Please I am having an issue where my PA app is not showing events and I am able to run searches and find some results : Background : I have moved all the VMs where we have our Splunk servers to different VLAN. After we did that our PA app is not parsing the data anymore. 1-for example : eventtype=pan this working properly and I can see the logs. the issue is that most of the logs are TRAFFIC logs. Looked for THREAT for example nothing. 2-We updated to the latest app and we can setup the sourcetype= pan:log our input file : [monitor:///apps/splunk_logs/panw/E*/panw.log] sourcetype = pan:log index = pan_logs host_segment = 4 ignoreOlderThan = 30d disabled = false We can see the sourcetype pan:log in the search results but not the others such as pan:threats, pan:config and so forth. 2-for the inputs file we have a deployment app that we're using and we have it as above. 3-I tried installing the app and the add-on locally and I have created /local/inputs.conf and added same info as above and still nothing is showing. Please Advise? Thanks! ... View more