About ramesh_babu71

ramesh_babu71 · ‎10-02-2018

Hi, I have a few adaptive responses (AR) which are tagged to run on correlation rule triggering. These Adaptive responses are working fine and getting the data. Now I want to save this AR data to a KVstore and tagged with an associated notable event ID. My intention is to fetch this data later using the notable event ID field. However, I can't find any way to access/get the notable event ID from within the adaptive response code. I tried using the helper.get_events() but it doesn't have a notable event ID field. Please let me know if anyone has done this before. Regards, Ramesh

ramesh_babu71 · ‎08-21-2018

Thanks for the update chli_splunk. I do see that the option of drop down list of index is not available for the section Alert Actions. But it is there in Data Collection of AoB Hard-coding index values doesn't serve the purpose as client will add/remove indexes in future. Meanwhile I added a new global text field called Index. Client is okay with this approach. Regards, Ramesh Babu

ramesh_babu71 · ‎08-21-2018

Thanks Michael for the update. I do see an entry in the add-on download page 18. August 2018 : 2.3.0 - added entity option but new version is not available for download yet. Can you share a tentative date on when the new version will be available for download ? Regards, Ramesh

ramesh_babu71 · ‎08-09-2018

Hello, I have a requirement in new app being build using add-on builder create a input parameter called choose index. This parameter should show the list of avalable indexes from which an user selects one index. I don't see this option in Splunk Add-on builder helper functions. However, Splunk doc does show such option in a picture just above the section called Pass values from data input parameters https://docs.splunk.com/Documentation/AddonBuilder/2.2.0/UserGuide/ConfigureDataCollectionAdvanced Another pic from an add-on which have this feature Can anyone help me on this please?

ramesh_babu71 · ‎02-21-2018

Hi, I see two (probably) new endpoints under server control. I'm using Splunk Enterprise 7.0.2 <link href="/services/server/control/restart_webui_async" rel="restart_webui_async"/> <link href="/services/server/control/restart_webui_polite" rel="restart_webui_polite"/> However couldn't find any documentation on the above two endpoints in Splunk docs http://docs.splunk.com/Documentation/Splunk/7.0.2/RESTREF/RESTsystem#server.2Fcontrol Would appreciate if anyone can share some insight into this.

ramesh_babu71 · ‎01-31-2018

Hello, Is there any way to use debug/refresh or _bump Splunk using API. I have tried the https://apps.splunk.com/app/1871/ app/code but it doesn't seem to be working on Splunk 7.0. I have kept a file in appserver/static folder which gets changed occasionally but Splunk always sends the cached old version until we refresh/_bump/restart. I have tried running the following rest API without success https://splunk3:8089/servicesNS/nobody/search/admin/myapp/_reload I am also open to using python request.post to send the refresh command. But it asks for username/passsword which I don't want users to provide app/script. http://splunk3:8000/debug/refresh -d splunk_form_key=5401708645855026883 Do we have any option to send this command with a sessionkey instead of credentials like in REST API ?

ramesh_babu71 · ‎01-22-2018

Hi Nick, We are keeping the files in the static folder so that these can accessed via http. In our other security solutions we can just point the IOC location as http://splunkserver:8000/static/app/ app_name/IOCfilename.csv If we move the files to lookups folder then we loose this facility.

ramesh_babu71 · ‎01-22-2018

Hello, We require your help implementing a part of solution for an app deployed in our Splunk SH cluster. The app is pushed to all the SH members using a deployer. The App contains a script which downloads IoCs and deposits in the location “$SPLUNK_HOME/etc/apps/app_name/appserver/static“ so that our other Security solutions can access it via HTTP(S). The App is designed to download only in SH captain. This part works very well. However we need a logic to copy/replicate the IOC files in /app_name/appserver/static (in captain) to other member servers too. The files in this location are CSV and JSON. Our goal is to access these files from remote location via web, If these files are kept updated in all peers then we can access it from any member server irrespective of which one is the actual captain node. Is there a way we can achieve this using Splunk only? We know this can be done using scp/share folder but client wants to do this within Splunk. Any help is appreciated.

ramesh_babu71 · ‎01-15-2018

Thanks @harsmarvania57 & @mayurr98 The below step worked even with the target Splunk instance being down. ./splunk remove shcluster-member -mgmt_uri <URI>:<management_port> Now it is not showing the message of Splunk instance being down in console or in Splunk bundle update. I didn't have to perform the resync kvstore. If i do it later on (to fix issues related this) I will update it here. I believe Splunk should update the documentation saying this works even if we need to remove entry of a SHC member which leaves abruptly . 🙂

ramesh_babu71 · ‎01-15-2018

@ mayurr98 I read this document but it specifically asks to keep (splunk service in) the instance we are removing running. Remove the member Caution: Do not stop the member before removing it from the cluster. However, In my case that can't be done as the server is already down and has been deleted (from VM console). Is it possible to run this command on another cluster member or captain even if the target server is down.

ramesh_babu71 · ‎01-15-2018

@ harsmarvania57 I read that document but it says to keep (splunk service in) the instance we are removing running. Remove the member Caution: Do not stop the member before removing it from the cluster. However, In my case that can't be done as the server is already down and has been deleted (from VM console).

ramesh_babu71 · ‎01-15-2018

Hmm...It was working fine. We have this environment for doing testing of Splunk App. It worked fine till now. We had 3 CentOS and 1 Windows for this setup. We even upgraded from 6.6 to 7.0 and was still working fine till the disk crash for windows server. Still others instances in the cluster are working fine other than the issue that it constantly shows the message of its missing windows server amigo 😞

ramesh_babu71 · ‎01-15-2018

Hi, We had four members in SH cluster (all in VM) and the setup was working properly until yesterday. Today one of the VM showed an error that it cannot power-on one of the SH cluster member as the disk has been corrupted beyond repairs. As of now we can work with 3 SH cluster members as it can elect captain and support our requirements well enough. However, while pushing updates via deployer we are getting error that it cannot reach this (down) SH and fails deploying Apps ./splunk apply shcluster-bundle --answer-yes -target https://splunkSH:8089 -auth username:Password Error while deploying apps to first member: Error while fetching apps baseline on target=https://192.x.x.x:8089: Network-layer error: No route to host Please let me know how can I remove the entry for this obsolete Splunk SH member from cluster list.

ramesh_babu71 · ‎12-15-2017

Thanks Alexandre. This worked like charm !!! These info should have been available in Splunk AoB docs.

ramesh_babu71 · ‎12-14-2017

Hello All, We created a scripted input using Python which connects to Splunk REST API using session key which it automatically gets using below code sessionKey = sys.stdin.readline().strip() However when we migrated to Splunk add-on builder the above code doesn't work even with below code in inputs.conf passAuth = admin Currently we are able to get session key only by sending authentication request (with Splunk username and password) and then stripping the Session Key from the response we receive. However we feel this method inadequate as our distributed environment has different credentials which makes administration of such Splunk App time consuming and frustrating. Please let us know if there methods (supported by addon builder) wherein we can get the session key without sending an auth request (Just like in normal scripted input way)

ramesh_babu71 · ‎11-30-2017

Thanks Harshil. This is what I was looking for. The POST command lets me to restart/enable the scripted input However a slight modification was required as \b in ".\bin...."python is taken as ASCII so we have to tell python to take it as string using r in front rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': r".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

ramesh_babu71 · ‎11-30-2017

Hi Jim, I received same update from vendor. I had manually update the config files to DB Connect v3 format to make it work.

ramesh_babu71 · ‎11-29-2017

Hi, I am trying to create a new app which will be used to send a Splunk Adaptive response via REST API. I am able get the response from Splunk REST API using using below code headers_server, content_server = rest.simpleRequest('/services/server/info?output_mode=json', sessionKey=sessionKey) However my requirement is to convert the below curl command which has a POST action to python REST API. curl -k -u admin:Password1 https://localhost:8089/services/data/inputs/script/restart?output_mode=json -d script=".\bin\script_test\windows.bat" Would require you help on how to send this POST command in python REST API format.

ramesh_babu71 · ‎11-27-2017

Thanks It worked 🙂

ramesh_babu71 · ‎11-27-2017

Thanks. It worked 🙂

Posts	28
Solutions	0
Karma Given	5
Karma Received	3
Member Since	‎02-07-2017

Online Status	Offline
Date Last Visited	‎07-08-2022 12:13 AM

How do you access notable event IDs from adaptive ...

Splunk addon builder - How to create an input that...

restart_webui_async and restart_webui_polite

debug refresh or _bump using REST API

Replicating/Copying files within Splunk SH Cluster...

Fixing Splunk SH cluster where one member left (Di...

Getting Session key for app built using add-on bui...

Splunk Adaptive Response sending post command in R...

Automatic Adaptive response action based on correl...

IP360 addon not working on DBconnect v3

How do you access notable event IDs from adaptive ...

Re: Splunk addon builder - How to create an input ...

Re: debug refresh or _bump using REST API

Splunk addon builder - How to create an input that...

restart_webui_async and restart_webui_polite

debug refresh or _bump using REST API

Re: Replicating/Copying files within Splunk SH Clu...

Replicating/Copying files within Splunk SH Cluster...

Re: Fixing Splunk SH cluster where one member left...

Re: Fixing Splunk SH cluster where one member left...

Re: Fixing Splunk SH cluster where one member left...

Re: Fixing Splunk SH cluster where one member left...

Fixing Splunk SH cluster where one member left (Di...

Re: Getting Session key for app built using add-on...

Getting Session key for app built using add-on bui...

Re: Splunk Adaptive Response sending post command ...

Re: IP360 addon not working on DBconnect v3

Splunk Adaptive Response sending post command in R...

Re: Automatic Adaptive response action based on co...

Re: Automatic Adaptive response action based on co...