About gazoscreek

richgalloway

Splunk explains what is sent at https://docs.splunk.com/Documentation/AIAssistant/latest/User/ShareData#Share_data

gazoscreek · ‎06-03-2025

Thank you for the quick and helpful reply. I figured that was probably the answer. In the meantime I'm working with the data owner at the origin to see if they can mitigate the issue on their end. Clearly something isn't right on the Azure client side and that'll need to be fixed.

sle_axn · ‎05-28-2025

Did you resolve this issue @gazoscreek ? I have same problem when upgrade from 9.2 to 9.4 currently.

gazoscreek · ‎05-07-2025

Thank you. THis worked perfectly!

gazoscreek · ‎12-12-2024

Thank you. IMHO, it's a change that probably should have been more widely announced and probably involved a touchpoint from account teams. This was a deviation from the way the UF's have operated since Day 1. (Yes, it's mentioned in the release notes ... but with no specific solutions to commonly ingested logs ... ) Like the release notes could have at least mentioned that in order to read Sysmon logs, you need to add "SplunkForwarder" to the Event Log Readers group. That took a while to figure out ... and yeah, it does appear that Event Log Readers doesn't imply all logs. So, yes. Application logs are going to be tricky to remediate. But at least we're not in danger of exceeding our license threshold. (¬_¬)

soberocean · ‎10-24-2024

Hey, I had the same issue and I fixed it by changing the user through Services:

PickleRick · ‎09-13-2024

Ok. This makes sense. Unfortunately. ES does some wacky things by running "inputs".

gazoscreek · ‎08-29-2024

Situation. Search Cluster - 9.2.2 5 nodes running Enterprise Security version 7.3.2 I'm in the process of adding 5 new nodes to the cluster. Part of my localization involves creating /opt/splunk/etc/system/local/inputs.conf with the following contents. ( the reason I do this is to make sure the host field for forwarded internal logs doesn't contain the FQDN like hostname in server.conf [default] host = <name of this host> When I get to the step where I run: splunk add cluster-member -current_member_uri https://current_member_name:8089 It works, but /opt/splunk/etc/system/local/inputs.conf is replicated from the current_member_name And, if I run something like: splunk set default-hostname <name of this host> ... it modifies inputs.conf on EVERY node of the cluster. Diving into this I believe this is happening because of the Domain Add-On DA-ESS-ThreatIntelligence which contains a server.conf file in it's default directory. (why this would be, I've no idea) contents of /opt/splunk/etc/shcluster/apps/DA-ESS-ThreatIntelligence/default/server.conf on our Cluster Deployer - which is now delivered to all cluster members. [shclustering] conf_replication_include.inputs = true It seems to me that it's this stanza that is causing the issue. Am I on the right track? And why would DA-ESS-ThreatIntelligence be delivered with this particular config? Thank you.

gazoscreek · ‎04-04-2024

Thank you kindly ... this worked perfectly.

jbillings21 · ‎10-23-2023

I know this is quite a late response, but you should be able to accomplish this with using the "Filter using Regex". Select "host" for Source Field In "Drop Events Matching Regular Expression", enter ^foo- That will set it so any events with the host field value, that starts with foo- will be dropped.

gazoscreek · ‎03-06-2023

Thank you @yuanliu & @ITWhisperer ... this was quite helpful ... the isnotnull doesn't seem to work where the values appear to be empty, but this did: index=_configtracker component=ConfigChange earliest=-6h host=mysearchheads* data.path="/opt/splunk/etc/apps/*" | spath path=data.changes{}.properties{} | mvexpand data.changes{}.properties{} | spath input=data.changes{}.properties{} | table data.changes{}.stanza, name, old_value, new_value | regex old_value="[A-Za-z0-9]" | regex new_value="[A-Za-z0-9]" Thank you very much.

richgalloway · ‎02-14-2023

Splunk does not record the name of the person who changed a search. One workaround is to make all changes in git and push them to Splunk on a regular basis. Any on-line changes would be overwritten by the push so users would have to use git if they want permanent changes.

dimasfs · ‎01-03-2023

My workaround was to specify (also on ssl.conf) the [sslConfig] caCertFile = <my_ca_file_relative_to_sslRootCAPath> BUT, as we can read at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf caCertFile = <filename> * DEPRECATED. Use the 'sslRootCAPath' setting instead. * Used only if 'sslRootCAPath' is not set. * File name (relative to 'caPath') of the CA (Certificate Authority) certificate PEM format file containing one or more certificates concatenated together. * Default: cacert.pem So I guess this is a matter of upgrading the app. I will file a case on it. The app was supposed to work without this deprecated setting.

gazoscreek · ‎04-07-2022

Perfect solution. Thank you so much!

sidoyle_ · ‎01-19-2022

I'm scratching my head over the same issue, i am new to Splunk and still finding my way around. Did you ever solve this problem ?

maplebuddy · ‎11-27-2021

@Knightrider1234 I found a solution. I searched and couldn't find an answer so I will post this here for anyone else that is experiencing the issue above. I initially started with the Microsoft Azure Add-on for Splunk. I found "The Event Hub input has been deprecated in this add-on. Please use the Splunk supported Splunk Add-on for Microsoft Cloud Services to ingest Event Hub data" on the inputs page of the app. I then figured out the difference: Microsoft Azure Add on for Splunk (now deprecated) -> ingests Eventhubs through old ClientSecret String Splunk Add-on for Microsoft Cloud Services -> ingests Eventhubs through modern Azure-AD app with Reader rights into eventhub You must navigate to Subscriptions -> your subscription -> Access Control (IAM) -> Select (+Add) and give the Splunk app Azure Event Hubs Data Receiver. In the Event Hub set-up of the Splunk Add-on for Microsoft Cloud Services give the FQDN only (e.g. lab-eventhub.servicebus.windows.net) and provide the event-hub name in the following field. This worked for me and I immediately started getting logs in. Hope this helps!

dodland · ‎10-01-2021

Did you ever get any traction on this? I have the same exact issue on two servers. One has 16GB of memory, the other has 56GB. Both seem to hover around the 68% mark for RAM usage.

gazoscreek · ‎09-08-2020

Anyone know when this AddOn will be made to work on 8.0.4 and above? Just had to back out of a Splunk upgrade because the add-on was spewing out pretty much nothing but python errors.

Posts	28
Solutions	1
Karma Given	9
Karma Received	4
Member Since	‎09-08-2020

Online Status	Offline
Date Last Visited	Monday

AI Assistant for SPL and data sharing

inputs.conf blacklist regex for: Splunk_TA_microso...

Linebreaking issue with Azure Keyvault sourcetype

Splunk Start fails after upgrading from 9.3.1 to 9...

Splunk UF after 9.1 - Access issues with IIS logs

Need help excluding etc/system/local/inputs.conf f...

Search Cluster Overwriting etc/system/local/inputs...

Ingest actions/nullQueue not working for some Wind...

Splunk Ingest Actions - Using Eval Expression Synt...

Auditing changes in _configracker index via json p...

Re: AI Assistant for SPL and data sharing

Re: inputs.conf blacklist regex for: Splunk_TA_mic...

Re: Splunk Start fails after upgrading from 9.3.1 ...

Re: Linebreaking issue with Azure Keyvault sourcet...

Re: Splunk UF after 9.1 - Access issues with IIS l...

Re: Why the ErrorCode 5 when trying to forward Sys...

Re: Need help excluding etc/system/local/inputs.co...

Search Cluster Overwriting etc/system/local/inputs...

Re: Ingest actions/nullQueue not working for some ...

Re: Splunk Ingest Actions - Using Eval Expression ...

Re: Auditing changes in _configracker index via js...

Re: Auditing Content Library

Re: Why did SA-ldapsearch stop working after upgra...

Re: How to return the daily event count of every i...

Re: Enterprise Security - Mitre Metrics

Re: Splunk Add-on for Microsoft cloud services

Re: Splunk AddOn Microsoft Cloudservices Memory Le...

Splunk AddOn for Microsoft Cloudservices Python 3 ...

Are you a member of the Splunk Community?