cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
bseppanen1
Explorer
Member since: ‎06-17-2020
‎11-08-2022
Community Statistics
Posts 9
Solutions 1
Karma Given 9
Karma Received 0
Member Since ‎06-17-2020
Activity Feed
View All

Re: ERROR MongodRunner [9060 KVStoreConfigurationT...

by in Splunk Enterprise
‎10-20-2022 12:48 PM
‎10-20-2022 12:48 PM
Just curious what special character you think that may have triggered this?  I'm seeing something possibly similar, but I'm skeptical it would be barfing on a "+" This is with version 9.0.1, and is what I'm seeing 10-20-2022 15:23:30.702 -0400 INFO loader [5164 MainThread] - JsonWebToken Manager registration with KVStore successful. 10-20-2022 15:23:30.826 -0400 INFO MongodRunner [7720 KVStoreConfigurationThread] - Found an existing PFX certificate 10-20-2022 15:23:30.826 -0400 INFO MongodRunner [7720 KVStoreConfigurationThread] - Using mongod command line --sslCertificateSelector subject=US 10-20-2022 15:23:30.826 -0400 INFO MongodRunner [7720 KVStoreConfigurationThread] - Using mongod command line --tlsDisabledProtocols noTLS1_0,noTLS1_1 10-20-2022 15:23:30.826 -0400 INFO MongodRunner [7720 KVStoreConfigurationThread] - Using mongod command line --sslCipherConfig ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256 10-20-2022 15:23:30.826 -0400 INFO MongodRunner [7720 KVStoreConfigurationThread] - Using mongod command line --noscripting 10-20-2022 15:23:30.873 -0400 ERROR MongodRunner [9524 MongodLogThread] - mongod exited abnormally (exit code 1, status: exited with code 1) - look at mongod.log to investigate. 10-20-2022 15:23:30.873 -0400 ERROR KVStoreBulletinBoardManager [9524 MongodLogThread] - KV Store process terminated abnormally (exit code 1, status exited with code 1). See mongod.log and splunkd.log for details. 10-20-2022 15:23:30.873 -0400 WARN KVStoreConfigurationProvider [9524 MongodLogThread] - Action scheduled, but event loop is not ready yet 10-20-2022 15:23:30.873 -0400 ERROR KVStoreBulletinBoardManager [9524 MongodLogThread] - KV Store changed status to failed. KVStore process terminated.. ... View more

Splunk Security Essentials Unmatched paranthesis i...

by in Knowledge Management
‎10-13-2021 09:01 AM
‎10-13-2021 09:01 AM
In the latest Splunk Security Essentials 3.4.0, and previous release the Data Inventory detection in CIM+Event Size Introspection starts a query that will never complete due to an unmatched paranthesis.    The query is autogenerated, so I'm not sure if this is due to a misconfiguration on my part, or perhaps just a unwanted feature.   (index=main source=WinEventLog:Security) ) OR (index=main source=WinEventLog:Security ) | head 10000 | eval SSELENGTH = len(_raw) | eventstats range(_time) as SSETIMERANGE | fields SSELENGTH SSETIMERANGE tag | fieldsummary ... View more
Labels

Re: Feeding data into a data model

by in Knowledge Management
‎10-08-2021 05:17 AM
‎10-08-2021 05:17 AM
So i did discover that there is a splunk add on specific to ISC DHCP and I did install that.    That add on doesn't seem to be CIM 4 compliant, so it appears I would have to do that lifting myself and worry that I will implement an Un-Common information model by doing so.     Thanks for your response.   It turns out that ISC DHCP Plugin does Support CIM definitions, so I just had to redefine the sourcetype for that to happen properly. ... View more

Feeding data into a data model

by in Knowledge Management
‎10-05-2021 11:49 AM
‎10-05-2021 11:49 AM
I'm working with a standalone splunk 8.1.3 instance with the Splunk CIM 4.20.2.      I have several accelerated data models that are populating data properly.    I have a couple of data sources,specifically an ISC DHCP server logging to a custom UDP port, and a Palo Alto firewall which is logging to its own index, that I'm not finding the data within the data model.   pan:traffic from the palo alto index should constitute network session data, and the ISC DHCP data should likewise.     Is there a way to find out why that data isn't being categorized in that manner?      Is there some way I can get that data in there properly?   Thanks,   ... View more
Labels

Re: Palo Alto Networks Add On (6.3.1) not parsing ...

by in All Apps and Add-ons
‎09-18-2020 05:40 AM
‎09-18-2020 05:40 AM
This appears to be due to changes in the logging of global protect within the PAN-OS release itself.    It appears to require explicit forwarding that was happening implicitly previously.    https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-logging-for-globalprotect.html ... View more

Palo Alto Networks Add On (6.3.1) not parsing glob...

by in All Apps and Add-ons
‎09-18-2020 05:06 AM
‎09-18-2020 05:06 AM
We swapped firewalls running version 8.1.15 and GP 4.1.12 to a replacement running version 9.1.4 and GP 4.1.12.   Prior to the upgrade Add on 6.3.0 was gathering data and appropriately displaying dashboard data.   After upgrading Add on and App to 6.3.1 I'm still getting nothing in my Global Protect Dashboard.   I'm not seeing data in the dashboard after the upgrade to 9.1.4.    I can see the data prior to the upgrade.   I've checked the forwarding configuration and that is fine: BSD Format and no timestamps appended.    Not sure what I'm missing.    Data models are at 100% and other than globalprotect seem to be ok. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-08-2022 09:01 AM