Minimum capabilities for Splunk mpreview for Splunk users with non-admin like default user, power role and user? Hi Everyone. I'm seeking some wisdom for minimum Splunk capabilities needed for "Splunk mpreview for Splunk users  with non-admin (with default user, power, power users) roles". created role like metrics_role with the capabilities https://docs.splunk.com/Documentation/Splunk/9.0.5/Security/Rolesandcapabilities (run_msearch, list_metrics_catalog, run_commands_ignoring_field_filter) and selected all the metrics indexes under the metrics tab and left the srchFilter/restrictions blank. Neither |mpreview index=awss3_metrics|head 9 nor |mcatalog values(metric_name) where index=awss3_metrics return any metric event. So far plan to promote usage of Splunk's metrics index hit a glitch. Would appreciate inputs at to what capabilities would be needed? Thanks in advance for your time. Bests. ... View more

Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20 After support tickets with Zoom and Splunk here are some experience would like to share. Using signed ssl certificates private or internal CA did not work. It seems that I had to use a certificate signed a commercial CA like Entrust. If you want to chain your ssl certificate with Entrust root and intermediate certificates, please ensure that the certificates are in the order as follows after running the command: openssl crl2pkcs7 -nocrl -certfile yoursslcertificate.entrust.pem | openssl pkcs7 -print_certs -noout Or you could just include the commercially issued ssl certificate without the root and intermediate certificates.       subject=/C=US/ST=STATE/L=CITY/O=ORG, Inc./CN=mycompany.com issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2       If all works after restarting Splunk, running the netstat -nap |grep 9997 will show the following connections from Zoom ip addresses and you would see logs under the sourcetype=zoom:webhook       tcp 0 0 0.0.0.0:4443 0.0.0.0:* LISTEN 25849/python3.7 tcp 0 0 10.#.#.#:4443 3.235.82.171:41101 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:58497 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:54514 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:48513 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:53006 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:55259 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:46028 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:52837 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:7527 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:12934 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.83.101:32088 TIME_WAIT -           ... View more

Splunk Connect for Zoom (Version 1.0.1, April 23, 2020, https://splunkbase.splunk.com/app/4961/) Disable the use of TLSv1.0 protocol in favor of a cryptographically stronger protocol such as TLSv1.2 Finding from Qualys QID-38628 on tcp port 4443 The following openssl commands can be used to do a manual test: openssl s_client -connect ip:port -tls1 If the test is successful, then the target support TLSv1 ... View more

It seems that the version 1.1.8 from Feb. 6, 2021still does not support Admin API v2 handlers for authentication logs according to URL: Does Duo's Splunk Connector support Admin API v2 handlers for authentication logs?  Are we supposed to use http://github.com/duosecurity/duo_log_sync/  to send to Splunk SIEM on 9997? But it seems that config.yml does not support sslPassword needed to write the logs to Splunk indexers? Could duo_splunkapp/bin/lib/duo_client 's files (client.py at version 4.1.0) be upgraded to the same version as the ones in duo_client-4.3.0-py3.7.egg/duo_client/client.py at version 4.3.0 ? Any other options or inputs? ... View more

Workday Add-on for Splunk (https://splunkbase.splunk.com/app/3783/#/details version 1.0.2) to support Multi Tenant setting. Trying to rename TA-workday to TA-workday44 (instead of TA-workday_tmp_1) as per the steps in https://community.workday.com/comment/860853#comment-860853 (to support multi tenants collection) using following steps. Files to be updated:           TA-workday_tmp_1\app.manifest (3 hits) Line 4: "title": "Workday Add-on for Splunk (tmp_1)", Line 7: "name": "TA-workday_tmp_1", Line 18: "description": "Workday Add-on for Splunk (tmp_1)", TA-workday_tmp_1\appserver\static\js\build\globalConfig.json (4 hits) Line 3: "name": "TA-workday_tmp_1", Line 7: "restRoot": "TA_workday_tmp_1" Line 294: "name": "workday_tmp_1", Line 295: "title": "workday_tmp_1", TA-workday_tmp_1\bin\ta_workday_tmp_1_declare.py (2 hits) Line 17: ta_name = 'TA-workday_tmp_1' Line 18: ta_lib_name = 'ta_workday_tmp_1' TA-workday_tmp_1\bin\TA_workday_tmp_1_rh_settings.py (2 hits) Line 2: import ta_workday_tmp_1_declare Line 150: 'ta_workday_tmp_1_settings', TA-workday_tmp_1\bin\TA_workday_tmp_1_rh_workday_tmp_1.py (2 hits) Line 2: import ta_workday_tmp_1_declare Line 63: 'workday_tmp_1', TA-workday_tmp_1\bin\workday_tmp_1.py (6 hits) Line 1: import ta_workday_tmp_1_declare Line 14: import input_module_workday_tmp_1 as input_module Line 30: super(ModInputworkday, self).__init__("ta_workday_tmp_1", "workday_tmp_1", use_single_instance) Line 36: scheme.title = ("workday_tmp_1") Line 60: return "TA-workday_tmp_1" TA-workday44/bin (added the step) mv ta_workday to ta_workday44 TA-workday_tmp_1\default\app.conf (5 hits) Line 11: description = Workday Add-on for Splunk (tmp_1) Line 15: label = Workday Add-on for Splunk (tmp_1) Line 19: id = TA-workday_tmp_1 Line 23: reload.ta_workday_tmp_1_account = simple Line 24: reload.ta_workday_tmp_1_settings = simple TA-workday_tmp_1\default\collections.conf (1 hit) Line 1: [TA_workday_tmp_1_checkpointer] TA-workday tmp 1\default\data\ui\views\configuration.xml (1 hit) Line 2: <view template="TA-workday_tmp_1:templates/base.html" type="html" isDashboard="False"> TA-workday_tmp_1\default\data\ui\views\home.xml (2 hits) Line 2: <label>TA-Workday_tmp_1_Add-on_for_Splunk</label> Line 3: <description>This is an example view in add-on TA-Workday_tmp_1_Add-on_for_Splunk</description> TA-workday_tmp_1\default\data\ui\views\inputs.xml (1 hit) Line 2: <view template="TA-workday_tmp_1:templates/base.html" type="html" isDashboard="False"> TA-workday_tmp_1\default\inputs.conf (1 hit) Line 1: [workday_tmp_1] TA-workday_tmp_1\default\restmap.conf (10 hits) Line 2: [admin:TA_workday_tmp_1] Line 4: members = TA_workday_tmp_1_settings, TA_workday_tmp_1_workday_tmp_1 Line 6: [admin_external:TA_workday_tmp_1_settings] Line 8: handlerfile = TA_workday_tmp_1_rh_settings.py Line 12: [admin_external:TA_workday_tmp_1_workday_tmp_1] Line 14: handlerfile = TA_workday_tmp_1_rh_workday_tmp_1.py TA-workday_tmp_1\default\web.conf (8 hits) Line 2: [expose:TA_workday_tmp_1_settings] Line 3: pattern = TA_workday_tmp_1_settings Line 6: [expose:TA_workday_tmp_1_settings_specified] Line 7: pattern = TA_workday_tmp_1_settings/* Line 10: [expose:TA_workday_tmp_1_workday] Line 11: pattern = TA_workday_tmp_1_workday Line 14: [expose:TA_workday_tmp_1_workday_specified] Line 15: pattern = TA_workday_tmp_1_workday/* TA-workday_tmp_1\README\inputs.conf.spec (1 hit) Line 1: [workday_tmp_1://<name>]           but still getting:           10-11-2021 14:29:03.878 +0000 ERROR AdminManagerExternal [6624 TcpChannelThread] - Stack trace from python handler: Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/splunktaucclib/rest_handler/handler.py", line 117, in wrapper for name, data, acl in meth(self, *args, **kwargs): File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/splunktaucclib/rest_handler/handler.py", line 168, in get output_mode='json', File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/solnlib/packages/splunklib/binding.py", line 289, in wrapper return request_fun(self, *args, **kwargs) File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/solnlib/packages/splunklib/binding.py", line 71, in new_fval = f(*args, **kwargs) File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/solnlib/packages/splunklib/binding.py", line 679, in get response = self.http.get(path, all_headers, **query) File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44/aob_py3/solnlib/packages/splunklib/binding.py", line 1183, in get return self.request(url, { 'method': "GET", 'headers': headers }) File "/opt/splunk/etc/apps/TA-workday44/bin/ta_workday44           Any pointers? Thanks. ... View more

Hi, Would like to use artifact_offset in https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob to troubleshoot why alert-when-rises-by-issue (http://answers.splunk.com/answers/6843/alert-when-rises-by-issue) does not seem to work for a savedsearch alert. The max artifact_offset seems to be only 3 for that alert. Not able to find a way to increase it to a high value. It would be nice to have an Advanced_Edit option for updating the artifact_offset of a savedsearch ... View more

All, 2 Splunk admin questions: 1) We have default_save_ttl = 604800 (7 days), but in /opt/splunk/var/run/splunk/dispatch there are folders older than 7 days according to https://docs.splunk.com/Documentation/Splunk/8.0.5/Search/ManagejobsfromtheOS the ttl, or length of time that job's artifacts (the output it produces) will remain on disk and available (ttl=)   Should we cleanup the old searches manually via cron, is that safe?  find  /opt/splunk/var/run/splunk/dispatch/  -maxdepth 1 -type d -mtime +8 -ls|wc -l 37   Here is outputs of limits.conf: /opt/splunk/bin/splunk cmd btool limits list --debug|grep ttl /opt/splunk/etc/system/default/limits.conf indexed_csv_ttl = 300 /opt/splunk/etc/system/default/limits.conf search_ttl = 2p /opt/splunk/etc/system/default/limits.conf concurrency_message_throttle_time = 10m /opt/splunk/etc/system/default/limits.conf max_lock_file_ttl = 86400 /opt/splunk/etc/system/default/limits.conf cache_ttl = 300 /opt/splunk/etc/system/default/limits.conf default_save_ttl = 604800 /opt/splunk/etc/system/default/limits.conf failed_job_ttl = 86400 /opt/splunk/etc/system/default/limits.conf remote_ttl = 600 /opt/splunk/etc/system/default/limits.conf replication_file_ttl = 600 /opt/splunk/etc/system/default/limits.conf srtemp_dir_ttl = 86400 /opt/splunk/etc/system/default/limits.conf ttl = 600 /opt/splunk/etc/system/default/limits.conf ttl = 300 /opt/splunk/etc/system/default/limits.conf cache_ttl_sec = 300 /opt/splunk/etc/system/default/limits.conf ttl = 86400   2) Also another question regarding from ps aux |grep 1598277129 root 29785 106 0.3 764344 282356 ? Sl 13:51 (UTC) 114:48 [splunkd pid=1771] search --id=1598277129.14351_B930C604-9D78-4B47-8E19-429E50F02A65 --maxbuckets=300 --ttl=600 --maxout=500000 --maxtime=0 --lookups=1 --reduce_freq=10 --rf=* --user=redacted --pro --roles=redacted the approve Splunk search process started/completed and have a ttl of 600 (10 minutes), and from search.log can see CANCEL and status=3, why is the search still running if CANCEL was issued? We do see quite a few of those cases and the CPU load is usually high in 8.0.2. Did not have that condition in Splunk 7.2.x. Any inputs?   08-24-2020 15:47:12.345 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=CANCEL 08-24-2020 15:47:12.345 INFO DispatchExecutor - User applied action=CANCEL while status=3 ... 08-24-2020 15:47:14.344 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=CANCEL 08-24-2020 15:47:14.345 INFO DispatchExecutor - User applied action=CANCEL while status=3 Thanks. ... View more

Hi, Getting following errors from failed |mcatalog search against metrics index using a power user role. The |mcatalog search runs ok with admin role. The search was running ok in Splunk 7.3.3 but getting error in Splunk 8.0.2. Power user role has the metric_alerts and list_metrics_catalog capabilities Search: |mcatalog values(metric_name) where index=os_metrics causing ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported ERROR SearchOrchestrator - Term based search is not supported ERROR SearchStatusEnforcer - sid:1597278941.14635_FE8E9C88-7BFB-466C-BA64-C8544C690C88 Term based search is not supported ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Term based search is not supported   Any suggestions on the cause of the "Term based search is not supported" and solution would be welcome. Thanks. ... View more