Below is my spl   |from datamodel:"Threat_Intelligence".""Threat_Activity" |dedup threat_match_field,threat_match_value |search NOT [|inputintelligence cisco_top_million_sites |rename domain as threat_match_value |table threat_match_value]    Explanation: basically from any threat activity detected, I want to remove false positives domains detected by using the cisco_top_million_sites as a reference to exclude FP domains. However, the part where domains in threat_match_value is compared to domains in cisco_top_million_sites  threat intel file, some domains are not getting excluded. Its mainly the content.dropboxapi.com domain which still appears in the results even though its in the threat intel file while other sub domains of the dropboxapi.com are excluded. Can someone please help with fixing this ? ... View more

  We have Splunk MISP 42 installed which was working until a few days ago. However, after installing Splunk Sec Essentials app, neither did the SSE app work from the get go but looks like it also messedup something that cause MISP42 app "config" page not to load and connection to MISP Since then, I have tried many things like uninstalling SSE app, updating MISP app to latest version from 4.0.1 and then reverting back to 4.0.1 when it was working fine. But despite of all this, issue is still there. I noticed similar proxy related message for Palo Alto addon in Splunkd logs which suggests this is more of a Splunk internal issue than MISP 42.   Splunk Core - 8.1.5 Issue is on single instance Splunk ES version 7.0.1 Can someone please help fix this ?       09-28-2022 00:05:06.486 +0000 ERROR AdminManagerExternal - Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [500]: Internal Server Error -- Traceback (most recent call last):\n File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 667, in urlopen\n self._prepare_proxy(conn)\n File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 930, in _prepare_proxy\n conn.connect()\n File "/opt/splunk/lib/python3.7/site-packages/urllib3/connection.py", line 316, in connect\n self._tunnel()\n File "/opt/splunk/lib/python3.7/http/client.py", line 927, in _tunnel\n message.strip()))\nOSError: Tunnel connection failed: 403 Forbidden\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/adapters.py", line 449, in send\n timeout=timeout\n File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 725, in urlopen\n method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]\n File "/opt/splunk/lib/python3.7/site-packages/urllib3/util/retry.py", line 439, in increment\n raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /servicesNS/nobody/misp42splunk/configs/conf-misp42splunk_instances/_reload (Caused by ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden')))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/splunktaucclib/rest_handler/handler.py", line 117, in wrapper\n for name, data, acl in meth(self, *args, **kwargs):\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/splunktaucclib/rest_handler/handler.py", line 175, in all\n self.reload()\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/splunktaucclib/rest_handler/handler.py", line 259, in reload\n action='_reload',\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 289, in wrapper\n return request_fun(self, *args, **kwargs)\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 71, in new_f\n val = f(*args, **kwargs)\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 679, in get\n response = self.http.get(path, all_headers, **query)\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 1183, in get\n return self.request(url, { 'method': "GET", 'headers': headers })\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/splunklib/binding.py", line 1241, in request\n response = self.handler(url, message, **kwargs)\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/splunk_rest_client.py", line 145, in request\n verify=verify, proxies=proxies, cert=cert, **kwargs)\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/api.py", line 60, in request\n return session.request(method=method, url=url, **kwargs)\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/sessions.py", line 533, in request\n resp = self.send(prep, **send_kwargs)\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/sessions.py", line 646, in send\n r = adapter.send(request, **kwargs)\n File "/opt/splunk/etc/apps/misp42splunk/lib/aob_py3/solnlib/packages/requests/adapters.py", line 510, in send\n raise ProxyError(e, request=request)\nsolnlib.packages.requests.exceptions.ProxyError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /servicesNS/nobody/misp42splunk/configs/conf-misp42splunk_instances/_reload (Caused by ProxyError('Cannot connect to proxy.', OSError('Tunnel connection failed: 403 Forbidden')))\n". See splunkd.log for more details.           ... View more

I have newly installed latest version of the Splunk Supporting Add-on for Microsoft Active Directory on Splunk ES. Firstly, no matter how many times, I click on the "+" sign to add new domain, nothing happens. Even if I add details on the default section and click "test connection", literally nothing happens. The last time I had worked on this addon was 4-5 years ago, even then its UI behavior was weird, but at least then the connection test use to be working but not it seems to have become even more terrible. Despite so many versions, I don't know what improvements they have exactly made. Can anyone please help in how to fix this ? ... View more