Hello, Ahmadkhattak20, We have not solved it, we open a case in splunk and they do not support that app either. The answer was the following "Hope you are doing really well! My name is Russel Andrey. After reviewing the information, I see that the support for this add-on is "Not Supported". Here you have more insights about App support types: https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Splunkbase/Appsupporttypes As best effort from my side, here you have some information that can be helpful for you: - This is the official documentation from the app: https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSplunkOperationsGuide_409.html In case the documentation or steps shared above are not working, I strongly suggest you creating your own question in our communities channel for further assistance. At this point, I will proceed archiving this support ticket." Thanks for your comprehension.     ... View more

  Hi Thanks for your answer but I need to get a list of all the existing sources and the datamdel to which it belongs Not in my Splunk ambient Something like that   ... View more

Hi richgalloway The problem I have is that a scan was performed to one of the servers where a universal forwarder is installed and a vulnerability in port 8089 of the splunk service was detected. To solve this problem, a digital certificate was requested, upload it to the deployment server, in a second scan the vulnerability is still active ... View more

Hi Soutamo,   The link process is already done, however the output of the files is .sqlaudit and in the same way Splunk does not index them 😞     ... View more

Hi Richgalloway   What process do you recommend?   Regards ... View more

Hi Giuseppe Linux... If you could share the script I would be very helpful 🙂 Thanks ... View more

Hi If you are receiving information in real time, either from an application, firewall, etc. and in some of your fields you are receiving the IP, you can use the iplocation or geostats command index =* sourcetype = * | iplocation "src_ip" | geostats count by country you can see the location by country, city, region ... View more

Hi Gravi Once I had a similar scenario, the first thing that worked for me was evaluated that both fields had the same type of data is "Strings" After validating that, perform the inner join command to make the cross and compare the data. Regards ... View more

Hello arulnight You can see the detail of your indexed on your search head server in the "Settings" "Licesing" "Usage Report" part There you will see graphs with the detail of your indexed daily, you can see the total GB of your license and when you are using the day in real time. Remember that in a period of 30 days you can have a maximum of 5 violations. If for any reason you exceed the 5 violations you enter into a serious issue of violations where at any time will stop indexing the information and you will not be able to perform searches. So you will need to contact the splunk support team to send you a "reset" license Regards ... View more

No, if you want to monitor logs that live on the server where you have splunk installed it is not necessary to install the forwarder. See a "configuration" "add data" "Monitor" and see the different options of how you can monitor the records. Optional use "Local event logs" or "Files and directories" for this option you need the path where the logs you want to monitor are stored. Regards ... View more