Hello, I recently upgraded the "Splunk Add-on for Microsoft Office 365" on my Splunk Heavy Forwarder to version 3.0.0, running on Splunk 8.1.4. I configured the "Cloud App Security" integration and the input for "Cloud Application Security Alerts". But, running the inputs, I think that this is bugged: the job is scheduled to download the alerts every 5 minutes. Every time the job runs, it downloads the alerts since the beginning (i. e.  from day 1 that the platform has been set up) and downloads just the first 100 alerts. Moreover, events are not indexed properly, since the timestamp that is applied is the timestamp at which the job runs, not the timestamp included in the event. Has everyone else experienced the same issue? Am I doing anything wrong?  Thanks in advance ... View more

Hi all, I have a Correlation Search that generates notable events ignoring the throttling configuration. The search is "Excessive Logins Failed" and is set with the current parameters: Cron schedule: */20 * * * * Time range: from '-65m' to 'now' Scheduling: continuous Schedule Window: No Window Scheduling priority: Default Trigger condition: number of results > 0 Throttling window: 86400 seconds Throttling fields to group by: src The search is the following:   | tstats summariesonly=true allow_old_summaries=true dc(Authentication.user) as "user_count",dc(Authentication.dest) as "dest_count",count from datamodel="Authentication"."Authentication" where Authentication.user!=*$ nodename="Authentication.Failed_Authentication" by "Authentication.app","Authentication.src" | `drop_dm_object_name(Authentication)` | replace "::ffff:*" with "*" in src | where count>=500   Search runtime is very short (few seconds), so I'm sure there are no overlapping searches at the same time. Nevertheless, I often find notable events generated for the same 'src' in the last 24 hours. I also have another Correlation Search (Brute Force Attacks detection) which have similar configuration/scheduling but in this case the throttling is working fine. Can anyone help me with this? Anybody else having the same issue? Thanks in advance ... View more

Hi everybody, I have recently enabled a new correlation search in my Splunk ES. This search looks for possible Ransomware file based on their extension. I have Splunk 8.1.4 running on Windows 2016 and Splunk ES 6.4.1. ES Content Update (the app where the search is defined) is at version 3.20.0. The original search was working good and it detected a suspicious file on one server. Since such file is expected, I put a whitelist in the correlation search just redefining a macro already available. This is the search:   | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | rex field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`   And I redefined the last macro as follows:   search NOT [ | inputlookup ransomware_ext_file_wl ]   The lookup defined contains only one column (file_name) and one row (the file name I want to white-list). If I run this search in a search panel, I got no results and this is the expected behavior. But when the search is executed by the scheduler, I always get a result (and a notable event) for such file that I put into whitelist. It's like the macro is not expanded correctly or the lookup is empty. Does anybody have any idea about the reason of getting different results? Thanks in advance. ... View more

Hi all, I've already been searching for an answer to my question within the community but I didn't find anything exhaustive.  Basically, I noticed different number for license usage if computed using the Rollover Summary (the "official" one) vs the Usage log type. Of course, I know that Rollover Summary logs refer to the previous day. Having in mind this, the issue happens not every day, but sometimes the license usage computed using the "Usage" logs is about 10% greater than the Rollover Summary. I'd like to understand why this happens since I'm experiencing some license violations and I'm trying to investigate which index/sourcetype is the main responsible. But this is not easy since the detailed usage aggregated doesn't correspond to the Rollover Summary. Just to be more clear, if I run this search on the License Master, I get a number for yesterday (say 100 GB):   index=_telemetry source=*license_usage_summary.log | eval _time=_time - 43200, usage_GB = round(b/1024/1024/1024, 3) | timechart span=1d sum(usage_GB) as usage_GB    while if I run this one, split by index, the aggregate gives me a value about 10% higher (110 GB):   index=_internal source=*license_usage.log* type=Usage st!="modular*" | eval gb=b/1024/1024/1024 | timechart span=1d sum(gb) AS idx_volume_GB by idx   The License Master is enabled on a Windows 2016 Server, with Splunk 7.3.6. Does anyone know why this happens and how to overcome this "issue"? Thanks in advance ... View more

Hi everyone, I have an issue when trying to generate a scheduled view and send it via email. Reading similar issues in the community, I set the following parameters in the savedsearches.conf file:   action.email.maxtime = 3600m dispatch.max_time = 14400   increased the limits in limits.conf:   [pdf] render_endpoint_timeout = 14400 [scheduler] scheduled_view_timeout = 240m   and the splunkd timeout in web.conf:   splunkdConnectionTimeout = 14400   In other words, I tried to extend the timeout to 4 hours. Nevertheless, after 1 hour the process tries to finalize the results and send the email, but it doesn't find any result and fails. This is the first line of the process inspector (see the timeout still set on 3600 seconds):   This search has completed in 3.608,538 seconds, but did not match any events   And this is the python.log (anonymized), see that seach starts at 12:00 and sendmail tries to send mail after 1 hour:   2020-11-09 12:00:48,466 +0100 INFO sendemail:1149 - sendemail pdfgen_available = 1 2020-11-09 12:00:48,466 +0100 INFO sendemail:1294 - sendemail:mail effectiveTime=1604919600 2020-11-09 13:00:48,502 +0100 ERROR __init__:499 - Socket error communicating with splunkd (error=('The read operation timed out',)), path = /services/pdfgen/render 2020-11-09 13:00:48,503 +0100 ERROR sendemail:1156 - An error occurred while generating a PDF: Failed to fetch PDF (SplunkdConnectionException): Splunkd daemon is not responding: ("Error connecting to /services/pdfgen/render: ('The read operation timed out',)",) 2020-11-09 13:00:48,503 +0100 INFO sendemail:1175 - buildAttachments: not attaching csv as there are no results 2020-11-09 13:00:52,118 +0100 INFO sendemail:134 - Sending email. subject="Splunk Dashboard: '<DASHBOARD_NAME>'", results_link="https://<SERVER_NAME>:8000/app/<app_name>/@go?sid=", recipients="[u'user_name@domain_name.it']", server="smtprelay.domain_name.it:25"   Has anybody ever had the same issue? Can anyone help me? Thanks in advance. ... View more