I've got a large JSON result from an API of the results from multiple domains {"success": true, "message": "OK", "data": {"submission-date": "2020-01-25", "finished-date": "2020-01-125", "name": "{'source': 'api.com Dashboard', 'type': 'web', 'account': 'test, 'list': 'domain'} 54354543543", "identifier": "6546423432432", "api-version": "1.0", "domains": [{"domain": "domain1", "status": "ok", "score": 55, "link": "https://api.com/site/domain1/55/", "categories": [{"category": "ipv6", "passed": true}, {"category": "dnssec", "passed": true}, {"category": "tls", "passed": false}, {"category": "appsecpriv", "passed": false}], "views": [{"name": "web_appsecpriv_csp", "result": true}, {"name": "web_appsecpriv_referrer_policy", "result": true}, {"name": "web_appsecpriv_x_content_type_options", "result": false}, {"name": "web_appsecpriv_x_frame_options", "result": true}, {"name": "web_appsecpriv_x_xss_protection", "result": false}, {"name": "web_dnssec_exist", "result": false}, {"name": "web_dnssec_valid", "result": false}, {"name": "web_https_cert_chain", "result": true}, {"name": "web_https_cert_domain", "result": true}, {"name": "web_https_cert_pubkey", "result": true}, {"name": "web_https_cert_sig", "result": true}, {"name": "web_https_dane_exist", "result": false}, {"name": "web_https_dane_valid", "result": false}, {"name": "web_https_http_available", "result": true}, {"name": "web_https_http_compress", "result": true}, {"name": "web_https_http_hsts", "result": false}, {"name": "web_https_http_redirect", "result": true}, {"name": "web_https_tls_ciphers", "result": true}, {"name": "web_https_tls_clientreneg", "result": true}, {"name": "web_https_tls_compress", "result": true}, {"name": "web_https_tls_keyexchange", "result": true}, {"name": "web_https_tls_secreneg", "result": false}, {"name": "web_https_tls_version", "result": true}, {"name": "web_ipv6_ns_address", "result": true}, {"name": "web_ipv6_ns_reach", "result": true}, {"name": "web_ipv6_ws_address", "result": false}, {"name": "web_ipv6_ws_reach", "result": false}, {"name": "web_ipv6_ws_similar", "result": false}]}, {"domain": "domain2", "status": "ok", "score": 99, "link": "https://api.com/site/domain2/35/", "categories": [{"category": "ipv6", "passed": true}, {"category": "dnssec", "passed": true}, {"category": "tls", "passed": true}, {"category": "appsecpriv", "passed": false}], "views": [{"name": "web_appsecpriv_csp", "result": true}, {"name": "web_appsecpriv_referrer_policy", "result": false}, {"name": "web_appsecpriv_x_content_type_options", "result": true}, {"name": "web_appsecpriv_x_frame_options", "result": true}, {"name": "web_appsecpriv_x_xss_protection", "result": false}, {"name": "web_dnssec_exist", "result": true}, {"name": "web_dnssec_valid", "result": true}, {"name": "web_https_cert_chain", "result": true}, {"name": "web_https_cert_domain", "result": true}, {"name": "web_https_cert_pubkey", "result": true}, {"name": "web_https_cert_sig", "result": true}, {"name": "web_https_dane_exist", "result": false}, {"name": "web_https_dane_valid", "result": true}, {"name": "web_https_http_available", "result": true}, {"name": "web_https_http_compress", "result": true}, {"name": "web_https_http_hsts", "result": true}, {"name": "web_https_http_redirect", "result": true}, {"name": "web_https_tls_ciphers", "result": true}, {"name": "web_https_tls_clientreneg", "result": true}, {"name": "web_https_tls_compress", "result": true}, {"name": "web_https_tls_keyexchange", "result": true}, {"name": "web_https_tls_secreneg", "result": true}, {"name": "web_https_tls_version", "result": true}, {"name": "web_ipv6_ns_address", "result": true}, {"name": "web_ipv6_ns_reach", "result": true}, {"name": "web_ipv6_ws_address", "result": true}, {"name": "web_ipv6_ws_reach", "result": true}, {"name": "web_ipv6_ws_similar", "result": true}]} I'm trying to get an overview of results per domain but I'm having difficulty getting the categories/views/results sorted per domain (domain1, domain2). So far I've tried spath and mvzip but I haven't found a way to combine the domains properly: index=json | spath | rename data.domains{}.domain as domain | rename data.domains{}.categories{}.category AS category, data.domains{}.categories{}.passed AS passed, data.domains{}.score AS score, data.domains{}.views{}.name AS viewname, data.domains{}.views{}.result AS viewresult | mvexpand domain | table domain, score, category, passed, viewname, viewresult Does anyone have a good method for this? ... View more

When trying to run the setup of an app we get an "Oops, Internal Error 550" message. 2019-10-15 18:44:13,055 ERROR [5da5f75c7c7fc82054ccd0] error:325 - Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 606, in respond cherrypy.response.body = self.handler() File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/htmlinjectiontoolfactory.py", line 72, in wrapper resp = handler(*args, **kwargs) File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cpdispatch.py", line 25, in __call__ return self.callable(*self.args, **self.kwargs) File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 366, in default return route.target(self, **kw) File "<string>", line 1, in <lambda> File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 38, in rundecs return fn(*a, **kw) File "<string>", line 1, in <lambda> File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 119, in check return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 167, in validate_ip return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 335, in preform_sso_check return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 374, in check_login return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 394, in handle_exceptions return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 449, in apply_cache_headers response = fn(self, *a, **kw) File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 1715, in listEntities app_name = eai_acl.get('app') AttributeError: 'NoneType' object has no attribute 'get' Anyone have a clue what issue is causing this? ... View more

When matching against threat intel the notable events only shows the source and destination of the matched event. Is there a way to make the correlation search only find specific events with a specific host and show the host in the notable event? For example, showing the source, destination and that it occured on firewall 2. ... View more

Following the documentation here https://docs.splunk.com/Documentation/Splunk/7.2.0/Metrics/GetMetricsInCollectd we're trying to get SNMP data with collectd into a metrics index. The current format we're receiving is as follows (about 50% of the entire event using sourcetype snmp_ta): ["value"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"cpu","plugin_instance":"2","type":"cpu","type_instance":"softirq"},{"values":[0],"dstypes":["derive"],"dsnames":["value"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"cpu","plugin_instance":"2","type":"cpu","type_instance":"idle"},{"values":[98.1006747093728],"dstypes":["derive"],"dsnames":["value"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"cpu","plugin_instance":"3","type":"cpu","type_instance":"idle"},{"values":[16.1998630209115,3.59996956020255],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"interface","plugin_instance":"ens192","type":"if_packets","type_instance":""},{"values":[2098.28607958568,6531.45666911971],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"interface","plugin_instance":"ens192","type":"if_octets","type_instance":""},{"values":[0,0],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"interface","plugin_instance":"ens192","type":"if_errors","type_instance":""},{"values":[0,0],"dstypes":["derive","derive"],"dsnames":["rx","tx"],"time":1540210462.641,"interval":10.000,"host":"localhost","plugin":"interface","plugin_instance":"ens192","type":"if_dropped","type_instance":""},{"values":[16.0999211648893,16.0999211648893],"dstypes":["derive","derive"],"dsnames": How do you get the right format for metrics? The events don't show up in the metrics index but no error shows up either in the _internal log. ... View more

Hi there, I'm trying to set up the Boss of the SOC v1 (BOTS) environment but I keep getting the following error while looking at the questions page in the app. I've followed all the steps in the guide (https://github.com/splunk/SA-ctf_scoreboard) so I'm confused why I keep getting this error. NoSectionError at "/opt/splunk/lib/python2.7/ConfigParser.py", line 607 : No section: 'ScoreboardController' TypeError at "/opt/splunk/lib/python2.7/json/decoder.py", line 364 : expected string or buffer Does anyone know what might cause this error? ... View more

Hi there, trying to exclude some events through the use of a lookup but it's not working for some reason: index=main src_ip="192.168.0.0/16" (dest_ip!="127.0.0.1" OR dest_ip!="127.0.0.2") | dedup dest_ip | lookup dns.csv destdns_ip as dest_ip OUTPUTNEW query | search NOT [| inputlookup dns_excludes.csv | fields query ] | table dest_ip,query dns.csv dest_ip, query 127.0.0.5, windows.com dns_excludes.csv query windows.com It shows the data normally but doesn't exclude the dns_excludes.csv. Does anyone know what I'm doing wrong here? ... View more