I have a log feed which was configured by a previous employee. Documentation does not exist, of course... The feed stopped once we migrated indexers. I checked the deployment server and there does not seem to be any apps on this server where the feed exists which ingest this feed. Then, we added in the old indexer to the architecture and the feed started working again! When I check these events in Search & Reporting, I can see the feed is only coming in via this legacy indexer by checking the splunk_server field. I logged into the legacy indexer via CLI and used btool on inputs for the index, source and sourcetypes, no matches. Also struggling to find anything useful in the _internal events via search head GUI. Both indexers are in a cluster and so the config should be identical, but the events only come in via the legacy indexer. How can I find how this feed is configured? ... View more

On my deployment server, when running btool check against inputs.conf and 'grep'ing for the name of my manually created app (which has nothing but a local directory, an inputs.conf and an automatically created app.conf file) I have a 'Invalid key in stanza [monitor]...' which complains about a line where I have; index = indexName And another error about; sourcetype = sourcetypeName I don't understand why Splunk doesn't like these lines. I can't find an appropriate inputs.conf.spec file where the issue could be fixed, but maybe I am not looking in correct place. When I run a btool check against all of our .conf files and Splunk is reporting that fields such as index, source, sourcetype, crcSalt, initCrcLength and more are invalid stanzas.   We have hundreds of such ‘invalid key’ errors. We also have hundreds of errors for “No spec file for:” for all .conf files other than inputs.conf – no such errors for inputs.conf. Maybe something major (or minor with major implications) went wrong after an upgrade? ... View more

A new entry appears every few days in the Forwarder Management area. Phone homes are only working for the latest entry. Same Host Name, same IP Address, only the Client Name is different. Any ideas? ... View more

I'm receiving the below error. I am on Splunk Enterprise 8.1.3 and using Solarwinds add-on version 1.2.0. The below is being generated on the heavy forwarder. The heavy forwarder is using Python version 3. We can successfully ping the Solarwinds server from this heavy forwarder. Does anybody have an idea as to what the issue might be here? 2022-02-01 11:59:28,107 +0000 log_level=ERROR, pid=5855, tid=Thread-4, file=ta_data_collector.py, func_name=index_data, code_line_no=113 | [stanza_name="OT_sowin_query"] Failed to index data Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_SolarWinds/bin/splunk_ta_solarwinds/aob_py3/cloudconnectlib/splunktacollectorlib/data_collection/ta_data_collector.py", line 109, in index_data self._do_safe_index() File "/opt/splunk/etc/apps/Splunk_TA_SolarWinds/bin/splunk_ta_solarwinds/aob_py3/cloudconnectlib/splunktacollectorlib/data_collection/ta_data_collector.py", line 129, in _do_safe_index self._client = self._create_data_client() File "/opt/splunk/etc/apps/Splunk_TA_SolarWinds/bin/splunk_ta_solarwinds/aob_py3/cloudconnectlib/splunktacollectorlib/data_collection/ta_data_collector.py", line 99, in _create_data_client self._data_loader.get_event_writer()) File "/opt/splunk/etc/apps/Splunk_TA_SolarWinds/bin/splunk_ta_solarwinds/aob_py3/cloudconnectlib/splunktacollectorlib/ta_cloud_connect_client.py", line 20, in __init__ from ..core.pipemgr import PipeManager File "/opt/splunk/etc/apps/Splunk_TA_SolarWinds/bin/splunk_ta_solarwinds/aob_py3/cloudconnectlib/core/__init__.py", line 1, in <module> from .engine import CloudConnectEngine File "/opt/splunk/etc/apps/Splunk_TA_SolarWinds/bin/splunk_ta_solarwinds/aob_py3/cloudconnectlib/core/engine.py", line 6, in <module> from .http import HttpClient File "/opt/splunk/etc/apps/Splunk_TA_SolarWinds/bin/splunk_ta_solarwinds/aob_py3/cloudconnectlib/core/http.py", line 26, in <module> 'http_no_tunnel': socks.PROXY_TYPE_HTTP_NO_TUNNEL, AttributeError: module 'socks' has no attribute 'PROXY_TYPE_HTTP_NO_TUNNEL' ... View more

When opening the Data Models page we have the below two errors, related to the SplunkforPaloAltoNetworks app / add-on. These errors have been present for a long time - definitely while on version 7.0.1, however we also just upgraded to the latest version, 7.0.3 and the errors persist. Any thoughts on how to resolve, or if likely a non-issue (we don't see any issues presently) how to remove? We have Splunk Cloud so will need to request Splunk team to assist. Same errors as in screenshot above, but as plain text; Error in data model "pan_traps" : JSON file contents not available. Error in data model "pan_wildfire_report" : JSON file contents not available. ... View more

Hi all, First of all, I realize this is achievable using Security Essentials, however we have a lot of manually created correlation searches and so need to add them manually - seems more work than creating a new search such as this. I have two lookup tables; 'MitreFramework.csv' which is a copy-paste of the Mitre Att&ck Matrix from https://attack.mitre.org, and 'mitre_enrichment.csv' which simply contains the technique names and their mitre_ids (fields are named exactly like this.) I have also annotated all of our correlation searches with their respective Mitre technique ID into up to three columns, export of which in a search shown below. I'm trying to compare the Mitre Technique ID's as above with the mitre_id field in the mitre_enrichment.csv lookup, to then get the corresponding 'technique' name, and then search for that technique field in the 'Mitre Framework.csv' lookup. If it exists, something happens to a table of the Mitre Framework to indicate that is it being covered (even appending a number of 1 to the cell, or only showing the cells which are matched would be okay). I know... this is a bit complicated, I'm hoping someone with more experience can see the logic and assist. Search for simply exporting the Mitre framework and annotations from the correlation rules is below. 'CHR' is simply part of the naming convention we use for all our rules;   | inputlookup MitreFramework.csv | append [| rest splunk_server=local count=0 /services/saved/searches | where disabled!=1 | search action.correlationsearch.label="CHR*" | rex field="action.correlationsearch.annotations" "^.*attack\":\[\"(?<Mitre1>T\d+)\"]?" | rex field="action.correlationsearch.annotations" "^.*attack\":\[\"T\d+\",\"(?<Mitre2>T\d+)\"" | rex field="action.correlationsearch.annotations" "^.*attack\":\[\"T\d+\",\"T\d+\",\"(?<Mitre3>T\d+?)\"" | table action.correlationsearch.label Mitre1 Mitre2 Mitre3 | rename action.correlationsearch.label as "Rule Name" Mitre1 as "Mitre Technique 1" Mitre2 as "Mitre Technique 2" Mitre3 as "Mitre Technique 3"]     ... View more