Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About PwC-Kimmy
PwC-Kimmy
Explorer
Member since:
04-12-2021
06-20-2023
Community Statistics
| Posts | 6 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-12-2021 |
Activity Feed
- Posted How to print timeline/notes in Splunk ES's investigations? on Splunk Enterprise. 06-16-2023 03:31 AM
- Posted Phantom Runner number of suggestions on Splunk SOAR. 05-19-2021 03:10 AM
- Posted Phantom can't receive the events from splunk on Splunk SOAR. 04-14-2021 08:14 PM
- Posted Re: Phantom - Testing Connectivity no response on Splunk SOAR. 04-12-2021 11:41 PM
- Posted Re: Phantom - Testing Connectivity no response on Splunk SOAR. 04-12-2021 08:39 PM
- Posted Phantom - Testing Connectivity no response on Splunk SOAR. 04-12-2021 02:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-16-2023
03:31 AM
When you print the summary of an investigation through ES it does not include notes. Is there a way to add those? Alternatively is there a way to use SPL to find those notes, artifacts, and events, to create a report from a custom dashboard?
... View more
Labels
- Labels:
-
administration
05-19-2021
03:10 AM
Our Phantom's DECIDED process often crashes for performance reasons. We suspect this is caused by the low number of runners. So if phantom server is 16 cores 256GB of memory, how many Runners should we set here?
... View more
Labels
- Labels:
-
configuration
04-14-2021
08:14 PM
I installed the Phantom App for Splunk & CIM app. And connectivity testing between Splunk and Phantom is passed. I created alerts on Splunk to send events to Phantom, but I didn't see any records in Phantom's events. From the index CIM_MODACTIONS, I can see an error log: “Unable to create container: cannot execute INSERT in a read-only transaction” So is that what's causing the problem? But I don't understand what permissions I'm missing.
... View more
Labels
- Labels:
-
troubleshooting
04-12-2021
11:41 PM
@phanTom Our security team enabled SELinux on the server, which caused the problem, and when we disabled SELinux, everything went back to normal. Thanks again for your help!
... View more
04-12-2021
08:39 PM
@phanTom Thank you for your help. I tried all the apps (like WHOIS) in the Phantom and they all returned the same result. Although ‘Test Connectivity’ does not display information, the app is actually working. I tried restarting the Phantom instance, also using a different browser and a different computer.
... View more
04-12-2021
02:43 AM
Hi All, I run the 'Testing Connectivity' on all Phantom apps and the response is as follows, showing no information (not even if the connection fails). How do I troubleshoot and resolve this error?
... View more
Labels
- Labels:
-
troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-20-2023
04:55 AM
|
