It seems that the version 1.1.8 from Feb. 6, 2021still does not support Admin API v2 handlers for authentication logs according to URL: Does Duo's Splunk Connector support Admin API v2 handlers for authentication logs?  Are we supposed to use http://github.com/duosecurity/duo_log_sync/  to send to Splunk SIEM on 9997? But it seems that config.yml does not support sslPassword needed to write the logs to Splunk indexers? Could duo_splunkapp/bin/lib/duo_client 's files (client.py at version 4.1.0) be upgraded to the same version as the ones in duo_client-4.3.0-py3.7.egg/duo_client/client.py at version 4.3.0 ? Any other options or inputs? ... View more

Workday Add-on for Splunk (https://splunkbase.splunk.com/app/3783/#/details version 1.0.2) to support Multi Tenant setting. Trying to rename TA-workday to TA-workday44 (instead of TA-workday_tmp_1) as per the steps in https://community.workday.com/comment/860853#comment-860853 (to support multi tenants collection) using following steps. Files to be updated:           TA-workday_tmp_1\app.manifest (3 hits) Line 4: "title": "Workday Add-on for Splunk (tmp_1)", Line 7: "name": "TA-workday_tmp_1", Line 18: "description": "Workday Add-on for Splunk (tmp_1)", TA-workday_tmp_1\appserver\static\js\build\globalConfig.json (4 hits) Line 3: "name": "TA-workday_tmp_1", Line 7: "restRoot": "TA_workday_tmp_1" Line 294: "name": "workday_tmp_1", Line 295: "title": "workday_tmp_1", TA-workday_tmp_1\bin\ta_workday_tmp_1_declare.py (2 hits) Line 17: ta_name = 'TA-workday_tmp_1' Line 18: ta_lib_name = 'ta_workday_tmp_1' TA-workday_tmp_1\bin\TA_workday_tmp_1_rh_settings.py (2 hits) Line 2: import ta_workday_tmp_1_declare Line 150: 'ta_workday_tmp_1_settings', TA-workday_tmp_1\bin\TA_workday_tmp_1_rh_workday_tmp_1.py (2 hits) Line 2: import ta_workday_tmp_1_declare Line 63: 'workday_tmp_1', TA-workday_tmp_1\bin\workday_tmp_1.py (6 hits) Line 1: import ta_workday_tmp_1_declare Line 14: import input_module_workday_tmp_1 as input_module Line 30: super(ModInputworkday, self).__init__("ta_workday_tmp_1", "workday_tmp_1", use_single_instance) Line 36: scheme.title = ("workday_tmp_1") Line 60: return "TA-workday_tmp_1" TA-workday44/bin (added the step) mv ta_workday to ta_workday44 TA-workday_tmp_1\default\app.conf (5 hits) Line 11: description = Workday Add-on for Splunk (tmp_1) Line 15: label = Workday Add-on for Splunk (tmp_1) Line 19: id = TA-workday_tmp_1 Line 23: reload.ta_workday_tmp_1_account = simple Line 24: reload.ta_workday_tmp_1_settings = simple TA-workday_tmp_1\default\collections.conf (1 hit) Line 1: [TA_workday_tmp_1_checkpointer] TA-workday tmp 1\default\data\ui\views\configuration.xml (1 hit) Line 2: <view template="TA-workday_tmp_1:templates/base.html" type="html" isDashboard="False"> TA-workday_tmp_1\default\data\ui\views\home.xml (2 hits) Line 2: <label>TA-Workday_tmp_1_Add-on_for_Splunk</label> Line 3: <description>This is an example view in add-on TA-Workday_tmp_1_Add-on_for_Splunk</description> TA-workday_tmp_1\default\data\ui\views\inputs.xml (1 hit) Line 2: <view template="TA-workday_tmp_1:templates/base.html" type="html" isDashboard="False"> TA-workday_tmp_1\default\inputs.conf (1 hit) Line 1: [workday_tmp_1] TA-workday_tmp_1\default\restmap.conf (10 hits) Line 2: [admin:TA_workday_tmp_1] Line 4: members = TA_workday_tmp_1_settings, TA_workday_tmp_1_workday_tmp_1 Line 6: [admin_external:TA_workday_tmp_1_settings] Line 8: handlerfile = TA_workday_tmp_1_rh_settings.py Line 12: [admin_external:TA_workday_tmp_1_workday_tmp_1] Line 14: handlerfile = TA_workday_tmp_1_rh_workday_tmp_1.py TA-workday_tmp_1\default\web.conf (8 hits) Line 2: [expose:TA_workday_tmp_1_settings] Line 3: pattern = TA_workday_tmp_1_settings Line 6: [expose:TA_workday_tmp_1_settings_specified] Line 7: pattern = TA_workday_tmp_1_settings/* Line 10: [expose:TA_workday_tmp_1_workday] Line 11: pattern = TA_workday_tmp_1_workday Line 14: [expose:TA_workday_tmp_1_workday_specified] Line 15: pattern = TA_workday_tmp_1_workday/* TA-workday_tmp_1\README\inputs.conf.spec (1 hit) Line 1: [workday_tmp_1://<name>]           but still getting:           10-11-2021 14:29:03.878 +0000 ERROR AdminManagerExternal [6624 TcpChannelThread] - Stack trace from python handler: Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/splunktaucclib/rest_handler/handler.py", line 117, in wrapper for name, data, acl in meth(self, *args, **kwargs): File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/splunktaucclib/rest_handler/handler.py", line 168, in get output_mode='json', File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/solnlib/packages/splunklib/binding.py", line 289, in wrapper return request_fun(self, *args, **kwargs) File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/solnlib/packages/splunklib/binding.py", line 71, in new_fval = f(*args, **kwargs) File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/solnlib/packages/splunklib/binding.py", line 679, in get response = self.http.get(path, all_headers, **query) File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/solnlib/packages/splunklib/binding.py", line 1183, in get return self.request(url, { 'method': "GET", 'headers': headers }) File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44           Any pointers? Thanks. ... View more

Hi, Would like to use artifact_offset in https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob to troubleshoot why alert-when-rises-by-issue (http://answers.splunk.com/answers/6843/alert-when-rises-by-issue) does not seem to work for a savedsearch alert. The max artifact_offset seems to be only 3 for that alert. Not able to find a way to increase it to a high value. It would be nice to have an Advanced_Edit option for updating the artifact_offset of a savedsearch ... View more

All, 2 Splunk admin questions: 1) We have default_save_ttl = 604800 (7 days), but in /opt/splunk/var/run/splunk/dispatch there are folders older than 7 days according to https://docs.splunk.com/Documentation/Splunk/8.0.5/Search/ManagejobsfromtheOS the ttl, or length of time that job's artifacts (the output it produces) will remain on disk and available (ttl=)   Should we cleanup the old searches manually via cron, is that safe?  find  /opt/splunk/var/run/splunk/dispatch/  -maxdepth 1 -type d -mtime +8 -ls|wc -l 37   Here is outputs of limits.conf: /opt/splunk/bin/splunk cmd btool limits list --debug|grep ttl /opt/splunk/etc/system/default/limits.conf indexed_csv_ttl = 300 /opt/splunk/etc/system/default/limits.conf search_ttl = 2p /opt/splunk/etc/system/default/limits.conf concurrency_message_throttle_time = 10m /opt/splunk/etc/system/default/limits.conf max_lock_file_ttl = 86400 /opt/splunk/etc/system/default/limits.conf cache_ttl = 300 /opt/splunk/etc/system/default/limits.conf default_save_ttl = 604800 /opt/splunk/etc/system/default/limits.conf failed_job_ttl = 86400 /opt/splunk/etc/system/default/limits.conf remote_ttl = 600 /opt/splunk/etc/system/default/limits.conf replication_file_ttl = 600 /opt/splunk/etc/system/default/limits.conf srtemp_dir_ttl = 86400 /opt/splunk/etc/system/default/limits.conf ttl = 600 /opt/splunk/etc/system/default/limits.conf ttl = 300 /opt/splunk/etc/system/default/limits.conf cache_ttl_sec = 300 /opt/splunk/etc/system/default/limits.conf ttl = 86400   2) Also another question regarding from ps aux |grep 1598277129 root 29785 106 0.3 764344 282356 ? Sl 13:51 (UTC) 114:48 [splunkd pid=1771] search --id=1598277129.14351_B930C604-9D78-4B47-8E19-429E50F02A65 --maxbuckets=300 --ttl=600 --maxout=500000 --maxtime=0 --lookups=1 --reduce_freq=10 --rf=* --user=redacted --pro --roles=redacted the approve Splunk search process started/completed and have a ttl of 600 (10 minutes), and from search.log can see CANCEL and status=3, why is the search still running if CANCEL was issued? We do see quite a few of those cases and the CPU load is usually high in 8.0.2. Did not have that condition in Splunk 7.2.x. Any inputs?   08-24-2020 15:47:12.345 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=CANCEL 08-24-2020 15:47:12.345 INFO DispatchExecutor - User applied action=CANCEL while status=3 ... 08-24-2020 15:47:14.344 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=CANCEL 08-24-2020 15:47:14.345 INFO DispatchExecutor - User applied action=CANCEL while status=3 Thanks. ... View more

Hi, Getting following errors from failed |mcatalog search against metrics index using a power user role. The |mcatalog search runs ok with admin role. The search was running ok in Splunk 7.3.3 but getting error in Splunk 8.0.2. Power user role has the metric_alerts and list_metrics_catalog capabilities Search: |mcatalog values(metric_name) where index=os_metrics causing ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported ERROR SearchOrchestrator - Term based search is not supported ERROR SearchStatusEnforcer - sid:1597278941.14635_FE8E9C88-7BFB-466C-BA64-C8544C690C88 Term based search is not supported ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Term based search is not supported   Any suggestions on the cause of the "Term based search is not supported" and solution would be welcome. Thanks. ... View more