I am trying to setup the DUO Splunk Connector and am getting the following error in Splunk Web upon submitting the configuration form: Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: ('The read operation timed out',)",) I have verified my Key and Host settings. Splunkd.log: 01-11-2018 09:32:31.789 -0700 INFO ModularInputs - <stderr> Argument validation for scheme=duo_input: Validating input 01-11-2018 09:33:01.751 -0700 ERROR ModularInputs - Argument validation for scheme=duo_input: killing process, because executing it took too long (over 30000 msecs). 01-11-2018 09:33:01.753 -0700 INFO ModularInputs - Argument validation for scheme=duo_input: script running failed (killed by signal 9: Killed). 01-11-2018 09:33:01.754 -0700 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: Broken pipe I believe that I need to raise a timeout setting, but my searches have turned up null when looking for any sort of timeout setting that the Splunk REST API references. ... View more

I have a folder in my Nessus Manager that I place any deprecated scans. We like to keep old scans for historical purposes. I would like to skip this folder when Splunk makes API calls to pull in the scan data from Nessus. I understand that the Python script "nessus_data_collector.py" is responsible for pulling in the scan data, but I am not confident enough with my Python skills to make this edit. Here's the API listing of the folder: { "unread_count": 0, "custom": 0, "default_tag": 0, "type": "custom", "name": "Deprecated", "id": 69 }, I'd provide the Python script itself, but it's 554 lines long -- I can reply with any specific definitions or classes if needed. ... View more

I have successfully configured LDAP to my organization's Active Directory and have several strategies configured; we have a massive disorganized domain, so I need to create multiple strategies to keep the returned results within the search time/size limits. I have one strategy that works just fine for the OU that it points to. However all other strategies (each pointing to different OUs) fail when users attempt to login with the following errors: AuthenticationManagerLDAP - Could not find user="somebody01" with strategy="Strategy 1" AuthenticationManagerLDAP - Could not find user="somebody01" with strategy="Strategy 2" AuthenticationManagerLDAP - Could not find user="somebody01" with strategy="Strategy 3" AuthenticationManagerLDAP - Could not find user="somebody01" with strategy="Strategy 4" AuthenticationManagerLDAP - Could not find user="somebody01" with strategy="Strategy 5" The user "sombody01" is discoverable via "Strategy 2" and in fact, enumerates when I browse to Settings > Access controls > Authentication method > LDAP strategies > (Strategy 2) Map groups > "theRelevantGroup-GG" I have tested using Domain Local vs. Domain Global Groups, rearranged the connection order (no connection errors so this was a shot in the dark), and adjusted my DN strings (however I am confident these are all correct [i.e. no errors upon Strategy save and as indicated above, user enumeration in web gui group mapping]), and the results are the same. I have searched for days and cannot find a comparable post, but please link if my Google/Duckduckgo/Splunk Answers fu was not good enough. Cheers. ... View more