About swatghare

swatghare · ‎12-16-2019

I had this issue when I missed created configuration for one of the Search Head Cluster instance. I validate the configuration and checked on each Search Head if they have same Config about IDX cluster and this solves the project.

swatghare · ‎05-28-2019

Thanks, Yes this worked , below is the link for enabling sticky session in AWS https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#sticky-sessions

swatghare · ‎05-28-2019

Hello I am facing a weird issue while accessing my Splunk Search Head via AWS Load Balancer. We have Splunk Search head cluster deployed on AWS Linux VM and we have placed Application Load Balancer so as to access the most available Splunk Search Head. When we enter the DNS of Load Balancer , we get the splunk search head login page but when we access the search head it do not show all of the features. It only shows, neither it displays the user name who logged in. I am not sure of the issue here but attaching the screenshot of home screen of search head to get idea what I see when I login as Admin. Does anyone faced this issue earlier , if yes then how can we resolve this? Regards, Sushant

swatghare · ‎12-27-2017

Strange but I do not see the Sophos Central entry in this? Do we know why is that happening, it was working all fine few days back. How do we resolve this ? Should we again re-integrate the Sophos Integration on HF or should we have this only on SH? We are more comfortable data coming from HF , however we can do this integration directly on SH as well. What steps we should perform to avoid this issue to re-occur again in future? any clue.

swatghare · ‎12-27-2017

Our Splunk environment is on AWS VM's on distributed mode. We have Heavy Forwarder which is configured with Sophos app for datacollection and putting it into custom index 'sophos' , we have same app on our Single SearchHead where it is used for Dashboard display. Is this something causing issue? I do not think so as HF have the local password file which we used for API collection, SearchHead do not have any password file as it is used only to display the content - we have tweaked the searches of dashboard in a way that it search 'sophos' index.

swatghare · ‎12-27-2017

Our Splunk environment is running over AWS VM' in distributed more. The Sophos collection is setup at Heavy Forwarder by installing same app, and we have installed same app in SearchHead for running dashboards. SH is not managed by DS, neither the HF. HF have Sophos app for datacollection , putting in Index called as 'sophos' and SH have app for display of dashboards. Regards, SW

swatghare · ‎12-26-2017

Hello Team, We have integrated Sophos Central SaaS account with Splunk using Sophos Central app. For the API collection we have created the token in Sophos SaaS account and then followed steps as given in app documentation. The integration was successful and we started seeing the logs into our Splunk environment. However after few days ( may be after 1 day itself) we stop getting logs from Sophos ( nothing was changed in Sophos SaaS API token) and we saw below errors: ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/sophos_central/bin/sophos_events.py" TypeError: argument of type 'NoneType' is not iterable ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/sophos_central/bin/sophos_events.py" if "central.sophos.com" in c['realm'] ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/sophos_central/bin/sophos_events.py" File "/opt/splunk/etc/apps/sophos_central/bin/sophos_events.py", line 17, in getCredentials ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/sophos_central/bin/sophos_events.py" endpoint, apiKey, auth = getCredentials(sessionKey) ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/sophos_central/bin/sophos_events.py" File "/opt/splunk/etc/apps/sophos_central/bin/sophos_events.py", line 31, in main() We then removed the integration thinking something went wrong with API collection and integrated again. However it again worked only for 2 days and now we again started getting same error messages as above. Need someone to provide any feedback on this. Regards, Sushant Watghare

swatghare · ‎11-23-2017

They cannot upgrade, as it is shared between many customer (shared SNOW) , so no plug in installation is possible. This is the reason we are trying Email Integration , but normal email integration have limited data it do not populate the data as done by pre-built apps in Splunk/SNOW. Do anyone have any script which can convert the ES Correlation Search into XML and feed into ServiceNow

swatghare · ‎11-17-2017

Hello We are trying to integrate Splunk (with Enterprise Security) with ServiceNow and we cannot use direct integration due to below points: 1. ServiceNow is using Jakarta version which we do not see currently being supported by Splunk 2. ServiceNow team is not ready to install Splunk plugin in their environment due to some techinical issues So we are trying to achieve the integration by sending ES Splunk Alert as Email and then Email inputs will be mapped with ServiceNow. We need help/information if we can get same fields / inputs from ES Correlation search into an Email so as to ticket in servicenow. If someone have tried earlier then please help me to get this integration working by getting same fields and inputs as we received through direct integration. Regards Sushant

swatghare · ‎09-05-2017

Hello Marked this as closed. I used below query to get the triggered alerts in dashboard: index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity" and then I linked it to API page from where we can drill down the alerts Regards Swatghare

swatghare · ‎08-17-2017

Hello All, I am trying to get the Trigger Alerts dashboard which will show the Alerts which are triggered, I am able to achieve the same using below search query: index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity" However when I click on the alerts listed on dashboard, if ofcourse takes me above query and not the real base search which is written to generate that alert. Does anyone know how do we create dashboard which displays all triggered alerts and if someone click on one specific alert it should display the results / events generated by alerts. Appreciate quick help. Regards Sushant Watghare

swatghare · ‎08-17-2017

Does anyone have solution to this? We also have similar requirement and needs inputs.

swatghare · ‎07-27-2017

Hello did you got this issue fixed? what was the resolution?

swatghare · ‎07-27-2017

Hi Did you got solution to this problem, I am having same issue. Regards Sushant

Posts	14
Solutions	1
Karma Given	0
Karma Received	3
Member Since	‎02-21-2017

Online Status	Offline
Date Last Visited	‎07-15-2021 05:51 AM

Issue accessing Splunk Search Head through AWS Loa...

Sophos Central app for Splunk: ExecProcessor error...

Splunk to Servicenow integration via Email

How can I make a dashboard with all triggered aler...

Re: Why do we get a "Failed to create a bundles se...

Re: Issue accessing Splunk Search Head through AWS...

Issue accessing Splunk Search Head through AWS Loa...

Re: Sophos Central app for Splunk: ExecProcessor e...

Re: Sophos Central app for Splunk: ExecProcessor e...

Re: Sophos Central app for Splunk: ExecProcessor e...

Sophos Central app for Splunk: ExecProcessor error...

Re: Splunk to Servicenow integration via Email

Splunk to Servicenow integration via Email

Re: How can I make a dashboard with all triggered ...

How can I make a dashboard with all triggered aler...

Re: Is there a way of automatically refreshing the...

Re: After installing Splunk on Linux and I navigat...

Re: Splunk doesn't launch