About TheBravoSierra

PrewinThomas

@TheBravoSierra If the app was originally deployed via deployer your steps should work. Ensure the directory is completely gone (no hidden files/permission issues). Regards, Prewin 🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

donzai · ‎02-05-2025

Below are the steps which need to perform for this password update; To update newer credentials in Qualys TA for Spunk, follow the below steps: Performed from Splunk Support side- =Click Settings> DATA> Data inputs. =On the Data inputs screen, click TA-QualysCloudPlatform. =On the Qualys screen, disable all the listed data inputs. =Open Linux console terminal. =Delete passwords.conf file (/opt/splunk/etc/apps/TA-QualysCloudPlatform/local/passwords.conf). =Reboot the idm splunk instance. (This can be done anytime, please dont ask for maintenance window - Just inform us once this completed so we can performed from our end) Performed from customer side- =Go to the Splunk UI, click Apps > Manage Apps. =Click Setup against the Qualys Technology Add-on for Splunk option. =On the TA-QualysCloudPlatform screen, enter new credentials under Qualys Credentials. =Click Save. Performed from Splunk side- =Open Linux console terminal. =Navigate through the path: /opt/splunk/etc/apps/TA-QualysCloudPlatform/local/ and check if the passwords.conf file created. =On the Qualys screen, enable all the listed data inputs.

kdubb2307 · ‎08-26-2024

So I got it to work but it is only after giving up completely on logic. So when installing the app the message is clearly asking for the username and password only not an email and password. To make my life easier I gave the same password to everything right so I wouldn't have to juggle passwords for a demo. So imagine my surprise when it kept saying the wrong username and password, so I finally said the heck with it and used my full email as my username and typed the password again, how about it worked and installed the app without any issues. So my only conclusion is this has to be worded wrong and is in fact asking for your email and password from the webpage sign-in and not the admin username and password which you would assume it is.

TheBravoSierra · ‎08-07-2024

Solution/workaround was to comment out the user_account_control_property lines in the default transforms/props files.

gcusello · ‎11-02-2023

Hi @TheBravoSierra, please try this: blacklist7 = EventCode\=4673.*Process Name:\s*C:\\Program Files\\WindowsApps.*\\win32\\DesktopExtension\.exe Ciao. Giuseppe

gcusello · ‎06-29-2023

Hi @TheBravoSierra, I suppose that you rebuilded the DataModel after time reduction. If no, rebuild it and the disk occupation should be less, if you already did, opena a case to Splunk Support because there isn't any reason for this behaviour. Ciao. Giuseppe

VatsalJagani · ‎06-05-2023

@TheBravoSierra - Are you having Sysmon data? That may have "wineventlog" (lower case) sourcetype value.

gcusello · ‎01-27-2023

Hi @TheBravoSierra, When I have to use the searches as they are, is I prefer to leave them in their own original app. If I have to modify them (any update!) I clone them in one my own app. This is an approch hinted to me by a Splunk Professional Service. Ciao. Giuseppe

PickleRick · ‎12-19-2022

It depends on the deployer push mode. With the default "merge to default" mode you should be able to simply remove app/default and push it again from the deployer. There is one caveat though - the updated app might have simply behaved in a way unexpected by older version instances and - for example - generated different summaries or "upgraded" kvstore contents. So it might not be that easy.

phwork · ‎09-27-2022

I'm having the same issue working in Dashboard studio, I am trying to increase the font size of the records in the table . I added the "fontSize" Attribute to the table. And like the suggestions above the Layout is absolute. Below are the screenshots of the code. Any suggestions on how to increase the font size? "viz_1qOASu7V": { "type": "splunk.table", "title": "", "description": "", "dataSources": { "primary": "ds_blah" }, "options": { "count": 15, "fontSize": 50 } "layout": { "type": "absolute", "options": { "height": 2500, "width": 2500, "backgroundImage": { "sizeType": "cover", "x": 0, "y": 0, "src": "/backgroungimage.jpeg" }, "display": "auto-scale" },

TheBravoSierra · ‎06-21-2022

I'm trying to run the below command on my search head cluster deployer: splunk start-shcluster-migration kvstore -storageEngine wiredTiger -isDryRun true I receive the following message: Admin handler 'shclustercaptainkvstoremigrate' not found. This is after I have edited $SPLUNK_HOME/etc/system/local/ on each search head in the cluster, following: Migrate the KV store storage engine - Splunk Documentation [kvstore] storageEngineMigration=true Please advise.

TheBravoSierra · ‎06-21-2022

I'm having the same issue...please advise. I have made appropriate changes to server.conf on shc nodes.

TheBravoSierra · ‎06-14-2022

I'm trying to change the color of a row in a table based on the value of a field 'action'. If it's equal to "allowed", I want the row to be green. If it's equal to "blocked", I want it to be red. How can this be done in the code? I'm not seeing much documentation online for manipulating context. Thanks in advance and appreciate the help.

Stefanie · ‎04-14-2022

What is the name of the Correlational Search that is having this issue? If you are sure that the index and sourcetype has the data it requires, is it possible that you are missing a Technical Addon that maps the data into a CIM format?

mattchiste · ‎04-04-2022

Ran into this same problem today. The short version is that the deployer's server.conf file needs a value for "pass4SymmKey" value in the [shclustering] stanza in order for the E.S. setup to detect that a Splunk instance is a Search Deployer (even though technically a Deployer doesn't seem to actually need this value explicitly set). If you care for more technical detail: Tracing backwards, you probably saw something like this in the logs: 2022-04-04 21:44:51,916+0000 INFO pid=85111 tid=MainThread file=ess_configured_handler.py:handle_ssl:230 | Standalone SH detected Digging into /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/ess_configured_handler.py, you find the code: def is_shc_deployer(session_key): ''' Determine whether we are on a SHC deployer ''' unused_r, c = rest.simpleRequest( 'configs/conf-server/shclustering', # noqa: X101 sessionKey=session_key, getargs={'output_mode': 'json'}, raiseAllErrors=True ) c = json.loads(c)['entry'][0]['content'] if c.get('pass4SymmKey'): return True return False ... so your server.conf file should have: [shclustering] pass4SymmKey=xxx ... in order for the auto-detection to work the way you'd expect in E.S.

gcusello · ‎02-22-2022

Hi @TheBravoSierra, you cannot put a subsearch adding the asterisks in main search, you have to modify your search. In addition, have you the cveID field both in the lookup and in the qualys index? remeber that to use a subsearch you need to have the same field name both in main search and subsearch. Anyway, you could run something like this: index=qualys [ | inputlookup cisa_cve.csv | rename cveID AS query | fields query ] | ... in this way you make a full text search in the qualys index using the lookup cveID field. Ciao. Giuseppe

TheBravoSierra · ‎02-09-2022

My inputs.conf was incorrect. I had a / at the end of PowerShell. Removed the / and now it is ingesting properly.

TheBravoSierra · ‎02-02-2022

Hi, I'm having an issue with my deployer and search head cluster while upgrading enterprise security. In step 8 of the Splunk doc below, it states that ES will recognize it is being installed on a cluster during app setup. Mine displays that it is setting up on a standalone instance, the deployer. What do I need to change for the GUI to recognize I am uploading for the cluster? See screenshot for additional detail. Upgrading Enterprise Security in a search head cluster environment, step 8: https://docs.splunk.com/Documentation/ES/7.0.0/Install/UpgradeEnterpriseSecuritySHC Thanks

somesoni2 · ‎10-18-2021

Create a separate inputs.conf stanza for /var/log/file.txt with crcSalt. Then blacklist file.txt from original /var/log monitoring stanza.

somesoni2 · ‎10-07-2021

The indexes.conf exists on SH so that index names appear on dropdowns (e.g. index name appears when you setup summary index OR in the "Add Data" wizard). Other than that, SH's indexes.conf are not used, you can safely remove/update that file/entry.

gcusello · ‎09-29-2021

Hi @TheBravoSierra, i you try to configure an app in a Search Head Cluster using the gui, you have an error and you cannot. Ciao. Giuseppe

kamlesh_vaghela · ‎06-29-2021

@TheBravoSierra Are you looking for this? YOUR_SEARCH | eval flag=if((x="example" OR x="example2" OR x="example3") and y="success", "true", "false") My Sample Search : | makeresults | eval x="example",y="success" |append [| makeresults | eval x="example2",y="failed" ] | eval flag=if((x="example" OR x="example2" OR x="example3") and y="success", "true", "false")

kamlesh_vaghela · ‎06-09-2021

@TheBravoSierra Can you please try this? [extract_file] REGEX =<Data Name='TargetFilename'>([^<]*) FORMAT = file::$1 [extract_md5] REGEX =<Data Name='Hashes'>MD5=([^,]+) FORMAT = md5::$1 [extract_sha256] REGEX =SHA256=([^<]+) FORMAT = sha256::$1 Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

venkatasri · ‎06-09-2021

Hi @TheBravoSierra [My_source_type] REPORT-file= extract_file [extract_file] REGEX = \<Data Name\=\'TargetFilename\'\>.*\\(?<file>[^<]+) FORMAT = file::$1 ----- An upvote would be appreciated if it helps!

TheBravoSierra · ‎06-03-2021

Hi, We're currently using host detection among other api calls with the Qualys app. I recently tried utilizing the activity log api, but am getting the below error in internal logs. Can anyone provide any insight or help? I'm unable to find anything in documentation. TA-QualysCloudPlatform (activity_log): 2021-06-03 14:05:39 PID=24006 [MainThread] INFO: Request failed withIOError, Retrying after 300 seconds: https://qualysapi.qualys.com/api/2.0/fo/activity_log/ with params={'action': 'list', 'output_format': 'csv', 'truncation_limit': 1000, 'since_datetime': '1999-01-01T00:00:00Z', 'until_datetime': '2021-06-03T19:15:35Z'}. Retry count: 8 TA-QualysCloudPlatform (activity_log): 2021-06-03 14:05:39 PID=24006 [MainThread] ERROR: IOError

Posts	50
Solutions	5
Karma Given	22
Karma Received	12
Member Since	‎01-12-2021

Online Status	Offline
Date Last Visited	yesterday

How do I uninstall an app from a search head clust...

regex

Datamodel size on disk doesn't make sense?

Clarification on WinEventLog vs wineventlog source...

What is best practice when utilizing a search from...

Updating App on SHC member via GUI

Admin handler 'shclustercaptainkvstoremigrate' not...

Dashboard studio: How do I change row color based ...

How to change font size of a table in Dashboard St...

How to specify Enterprise Security sourcetypes?

Re: How do I uninstall an app from a search head c...

Re: Having trouble setting up TA-QualysCloudPlatfo...

Re: Why am I unable to log in to install apps?

Re: Why this error on search head cluster after up...

Re: regex

Re: Datamodel size on disk

Re: Clarification on WinEventLog vs wineventlog so...

Re: Best practice - search creation

Re: Updating App on SHC member via GUI

Re: How to change font size of a table in Dashboar...

Admin handler 'shclustercaptainkvstoremigrate' not...

Re: Why is there an error while performing "Migrat...

Dashboard studio: How do I change row color based ...

Re: Enterprise Security sourcetypes

Re: How to install a fresh install of Enterprise S...

Re: How to match my list of qualys events against ...

Re: How to pull in Windows Event logs from the Win...

Upgrading Enterprise Security in search head clust...

Re: Reindex linux log file

Re: Search head indexes.conf

Re: SHC update apps

Re: Help with Boolean query

Re: Using regex in field extraction

Re: Regex in transforms.conf

Qualys IOError Activity log

Join the Conversation