Hi , We are facing issues in listing available splunk indexes in SplunkCloud using  splunklib.client.connect provided by splunklib library. Below is the code snippet used: service = splunklib.client.connect(host=host, token=session_token) ind_list = service.indexes.list() This code works perfectly fine in the splunk enterprise and previous splunk cloud versions but noticed this issues happening on the latest versions (8.2.2202 and above). When this code executes on the 8.2.2202 and above we notices the following debug line, which clearly shows the timeout error while fetching the indexes as below: We see this timeout error because the splunk  is not returning the index names ,since it is failing to connect to splunk cloud. ERROR 2022-10-03 05:39:22,296 CiscoCloudSecurity : API: fetch_indexes, Exception : [Errno 110] Connection timed out Traceback (most recent call last): File "/opt/splunk/etc/apps/cisco-cloud-security/bin/fetch_indexes.py", line 26, in handle ind_list = service.indexes.list() File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/client.py", line 1479, in list return list(self.iter(count=count, **kwargs)) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/client.py", line 1438, in iter response = self.get(count=pagesize or count, offset=offset, **kwargs) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/client.py", line 1668, in get return super(Collection, self).get(name, owner, app, sharing, **query) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/client.py", line 766, in get **query) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 290, in wrapper return request_fun(self, *args, **kwargs) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 71, in new_f val = f(*args, **kwargs) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 686, in get response = self.http.get(path, all_headers, **query) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 1199, in get return self.request(url, { 'method': "GET", 'headers': headers }) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 1259, in request response = self.handler(url, message, **kwargs) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 1399, in request connection.request(method, path, body, head) File "/opt/splunk/lib/python3.7/http/client.py", line 1281, in request self._send_request(method, url, body, headers, encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1327, in _send_request self.endheaders(body, encode_chunked=encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1276, in endheaders self._send_output(message_body, encode_chunked=encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1036, in _send_output self.send(msg) File "/opt/splunk/lib/python3.7/http/client.py", line 976, in send self.connect() File "/opt/splunk/lib/python3.7/http/client.py", line 1443, in connect super().connect() File "/opt/splunk/lib/python3.7/http/client.py", line 948, in connect (self.host,self.port), self.timeout, self.source_address) File "/opt/splunk/lib/python3.7/socket.py", line 728, in create_connection raise err File "/opt/splunk/lib/python3.7/socket.py", line 716, in create_connection sock.connect(sa) TimeoutError: [Errno 110] Connection timed out Please let us know how we can resolve this issue on cloud . Thanks.   ... View more

Hi all, We have a case where we want to restrict a user from editing or updating  a input parameter . We have created a addon using Splunk's Add-on builder (v4.x), the addon takes couple of Data Input Parameters, which include a parameter that has to be disabled and should not be allowed to be updated. Is there a way we can update the code or does addon builder provide a option to perform such functionality? Any help or suggestions will be highly appreciated.   Thanks, Jabez. ... View more

Hi ,  Noticed this failure in the app inspect report(Version 2.22.0), Is there a way we can fix this on splunk cloud ? Below is the failure details in the report: Please check for inbound or outbound UDP network communications.Any programmatic UDP network communication is prohibited due to security risks in Splunk Cloud and App Certification.The use or instruction to configure an app using Settings -> Data Inputs -> UDP within Splunk is permitted. (Note: UDP configuration options are not available in Splunk Cloud and as such do not impose a security risk. File: bin/botocore/session.py Line Number: 204   Thanks, Jabez.   ... View more

Hi All,  We are facing a issue when running app inspect(version 2.22.0) report on our app, below is the failure we see: Embed all your app's front-end JS dependencies in the /appserver directory. If you import files from Splunk Web, your app might fail when Splunk Web updates in the future. Bad imports: ['moment'] File: /tmp/tmpylhrwm6y/cisco-cloud-security/appserver/static/vendor/chartjs/Chart.min.js Embed all your app's front-end JS dependencies in the /appserver directory. If you import files from Splunk Web, your app might fail when Splunk Web updates in the future. Bad imports: ['moment'] File: /tmp/tmpylhrwm6y/cisco-cloud-security/appserver/static/vendor/chartjs/Chart.js Embed all your app's front-end JS dependencies in the /appserver directory. If you import files from Splunk Web, your app might fail when Splunk Web updates in the future. Bad imports: ['moment'] File: /tmp/tmpylhrwm6y/cisco-cloud-security/appserver/static/vendor/daterangepicker/daterangepicker.min.js As per the error description we have placed all our Js dependencies under /appserver folder, but we still see this failure. Any help or suggestion are highly appreciated.   Thanks, Jabez. ... View more

HI, We are trying to process and  ingest  aws s3 events into splunk, but noticed few events are getting split, after checking the configuration we realized this should be caused by splunk internal parsing algorithm.  Please let us know if there is any issues in my configuration or could it be something related to splunk parser? Below is the entries on props and transform.conf: props--> [proxy] REPORT-proxylogs-fields = proxylogs_fields,extract_url_domain LINE_BREAKER = ([\r\n]+) # EVENT_BREAKER = ([\r\n]+) # EVENT_BREAKER_ENABLE = true SHOULD_LINEMERGE = false CHARSET = AUTO disabled = false TRUNCATE = 1000000 MAX_EVENTS = 1000000 EVAL-product = "Umbrella" EVAL-vendor = "xyz" EVAL-vendor_product = "abc" MAX_TIMESTAMP_LOOKAHEAD = 22 NO_BINARY_CHECK = true TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S TZ = UTC   Transforms.conf --> [proxylogs_fields] DELIMS = "," FIELDS = Timestamp,policy_identities,src,src_translated_ip,dest,content_type,action,url,http_referrer,http_user_agent,status,requestSize,responseSize,responseBodySize,sha256,category,av_detection,pua,amp_disposition,amp_malwarename,amp_score,policy_identity_type,blocked_category,identities,identity_type,request_method,dlp_status,certificate_errors,filename,rulesetID,ruleID,destinationListID,s3_filename example of the events: "2022-06-27 08:57:14","wer.com","1.1.1.1","1.1.1.1","10.10.10.10","image/gif","ALLOWED","https://www.moug.net/img/btn_learning.gif","https://www.mikhgg.net/tech/woopr/0025.html","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.124 Safari/537.36 Edg/102.0.1245.44","200","","3571","3328","1a146b09676811234dddccd6dc0ee3cf11aa1803e774df17aa9a49a7370a40ec","Allow List,Fashion","","","","","","AD Users","","wer.com","AD Users,Network Tunnels","GET","ALLOWED","","btn_learning.gif","13347559","346105","15065619",2022-06-27-09-50-ade8.csv.gz   Events as seen in splunk:     ... View more

Hi All, I'm trying to get my existing addon updated with the latest splunk add-on builder v4.We had developed the existing addon with a previous version of add-on builder , we got a information from the splunk team to rebuild the addon with latest builder. It will be of great help if you can provide me links on how this can be done, or any advise.   Thanks. ... View more

HI , I'm working on developing a app, I observed that the only capability available for a user to access or edit kvstore is using admin_all_object. Can you please suggest if there are any other capability to achieve this? As a admin we do not prefer giving users this capability(admin_all_object) just to access the kvstore.   Even if i give this capability the app inspect ,points out at this as an error. check_authorize_conf_admin_all_objects_privileges default/authorize.conf [role_cs_admin] contains `admin_all_objects = enabled`. File: default/authorize.conf Line Number: 16   ... View more

Hi, I am trying to validate my app with app inspect and im getting the following error, I have tried multiple solutions but couldn't get through. Extract from App Inspect [ Failure Summary ] Failures will block the Cloud Vetting. They must be fixed. check_inputs_conf_spec_stanzas_has_python_version_property Modular input "cloudlock" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 1 Modular input "cloudlock_health_check" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 4 Modular input "destination_lists_health_check" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 7 Modular input "investigate_health_check" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 10   Following is my configurations in  README/inputs.conf.spec [cloudlock://<name>] Log_Level = INFO [cloudlock_health_check://<name>] Log_Level = INFO [destination_lists_health_check://<name>] Log_Level = INFO [investigate_health_check://<name>] Log_Level = INFO   Following is my configurations in input.conf [cloudlock://incidents] disabled = 0 interval = 60 Log_Level = INFO python.version = python3 [cloudlock_health_check://health_check_cloudlock_batch_job] disabled = 0 interval = 600 Log_Level = INFO python.version = python3 [destination_lists_health_check://health_check_destination_lists_batch_job] disabled = 0 interval = 600 Log_Level = INFO python.version = python3 [investigate_health_check://health_check_investigate_batch_job] disabled = 0 interval = 600 Log_Level = INFO python.version = python3   Please help me with a solution . ... View more

Hi Guys, I'm facing a problem when restarting/starting splunk in windows,i get this message that the port is already bound,but i want to use the default ports.Please help!!!. Majority of the times i'm facing this issue on mgmt port(8089) and kvstore port(8191). After i had stopped splunk and started it ,here im seeing the mgmt port is bound. I tried killing the PIDs running on the port...but im not able to  free the ports. I'm not able to kill few Process ,says "no running instance of the task" ,though i can see the PIDs exists. ERROR: The process with PID 7636 could not be terminated. Reason: There is no running instance of the task.    Can you please suggest me on what should be done? Thanks in advance! ... View more