About Gene

Gene · ‎03-26-2024

As I mentioned - problem was that we have an application on UF's and indexers for SSL log encryption. The problem was that someone put in config file wrong password for .*pem file and because of that forwarders started to disappear from the console, as inactive. First thing what you should check - review both indexer and forwarder logs for any connection problems. Best, Eugene

Gene · ‎11-19-2023

@meekahHope you've figured out on how to ingest salesforce logs, but just in case please try to Turn Off "Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows" checkbox in your Connected App's settings. It is located under the Scopes and Callback URLs (at least in old UI). Have found different topics with same problem and same resolution

Gene · ‎10-19-2023

Trying also to figure out the problem. From salesforce topics they state that some permissions are missing on salesforce side. Will update shortly when solution is found

Gene · ‎05-11-2022

Hello, unfortunately in Splunk there is no such possibility. I have registered an idea for Splunk developers, you can give your vote for it and maybe in near future they will implement it https://ideas.splunk.com/ideas/ESSID-I-142

Gene · ‎02-11-2022

Hello, I am trying to integrate Splunk and Resilient and faced with the following problem: in adaptive response I have mapped all required and interesting fields to be send to Resilient. After event is triggered - only raw data comes to SOAR. I have checked no errors on splunk side. On Resilient side there was error, but I have also fixed it - no luck com.co3.domain.exceptions.FieldsRequiredException: The following fields are required: 'cs_cloud_url','cs_sensor_id' com.ibm.resilient.common.domain.exceptions.Co3IllegalArgumentException: Incident name cannot be null/empty Do you have any ideas why only raw data comes from splunk? Thank you

Gene · ‎02-11-2022

Thank you all for help. The problem was in SSL keys. I don't know what happened and how did they connect for the first time, but after I have created new keys and published to forwarders - problem disappeared. BTW: no error in logs regarding SSL/

Gene · ‎01-11-2022

Actually I don't know, have checked server.conf files both on DC and DS - and didn't find pass4symmkey there.

Gene · ‎01-11-2022

I have checked logs and still can't find what's wrong: 01-11-2022 14:20:18.073 +0200 INFO DC:HandshakeReplyHandler [13276 HttpClientPollingThread_85591AD8-9097-47F4-B73E-4F63150ACA4D] - Handshake done 01-11-2022 14:21:30.273 +0200 INFO DS_DC_Common [5620 MainThread] - Initializing the PubSub system. 01-11-2022 14:21:30.273 +0200 INFO DS_DC_Common [5620 MainThread] - Initializing core facilities of PubSub system. 01-11-2022 14:21:30.335 +0200 WARN HTTPAuthManager [5620 MainThread] - pass4SymmKey length is too short. See pass4SymmKey_minLength under the general stanza in server.conf. 01-11-2022 14:21:30.335 +0200 INFO HttpPubSubConnection [872 HttpClientPollingThread_85591AD8-9097-47F4-B73E-4F63150ACA4D] - Initial attempt to obtain connection will try after=37.475 seconds. 01-11-2022 14:21:30.335 +0200 INFO DC:DeploymentClient [5620 MainThread] - Starting phonehome thread. 01-11-2022 14:21:30.335 +0200 INFO DS_DC_Common [5620 MainThread] - Deployment Client initialized. 01-11-2022 14:21:30.335 +0200 INFO ServerRoles [5620 MainThread] - Declared role=deployment_client. 01-11-2022 14:21:30.335 +0200 INFO DS_DC_Common [5620 MainThread] - Deployment Server not available on a dedicated forwarder. 01-11-2022 14:21:30.335 +0200 INFO DC:PhonehomeThread [6308 PhonehomeThread] - Phonehome thread start, intervals: handshakeRetry=12.0 phonehome=60.0. 01-11-2022 14:21:30.335 +0200 INFO ClusteringMgr [5620 MainThread] - initing clustering with: ht=60.000 rf=3 sf=2 ct=60.000 st=60.000 rt=60.000 rct=5.000 rst=5.000 rrt=10.000 rmst=600.000 rmrt=600.000 icps=25 sfrt=600.000 pe=1 im=0 ip=0 mob=5 mor=5 mosr=5 pb=5 rep_port= pptr=10 pptrl=100 fznb=10 Empty/Default cluster pass4symmkey=false allow Empty/Default cluster pass4symmkey=true rrt=restart dft=180 abt=600 sbs=1 01-11-2022 14:21:30.335 +0200 INFO DC:DeploymentClient [6308 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 01-11-2022 14:21:42.338 +0200 INFO DC:DeploymentClient [6308 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 01-11-2022 14:21:54.338 +0200 INFO DC:DeploymentClient [6308 PhonehomeThread] - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

Gene · ‎01-11-2022

Yes, correct. That is why I suspect that some firewall rules are blocking this connection, maybe some beckoning rules....

Gene · ‎01-11-2022

Thx for the suggestion, but the strangest thing is that all forwarders are sending data as expected also to indexer, that is configured as DS. But not seen in console.

Gene · ‎01-11-2022

Actually all settings are default, we didn't touch polling time. I will try to play with that also, thx

Gene · ‎01-11-2022

DS is not restarting or crashing, the thing is that clients connect only once and after they can't reach DS. I assume that problem is with Firewall rules but for now client is checking this.

Gene · ‎12-30-2021

Versions are the same. btool and show deploy-poll show correct values. telnet - clarifying with client, cause do not have access to endpoints where forwarders are installed. and clients are in the same subnet, no VPN is used.

Gene · ‎12-30-2021

I mean only one

Gene · ‎12-30-2021

Yes, correct.

Gene · ‎12-30-2021

Hi, and thank you for response. But actually situation is following: we set up forwarders=>set DS=> they appear in console=> they disappear from console=> some of them sometimes appear, but not for a long time I suppose that this can be connected to some firewall settings, but client assures that they can't find any connections that were blocked during that time. Also UF logs show: INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

Gene · ‎12-29-2021

Dear Splunkers, Can you please assist with following problem: We have more 20 UF's installed on windows machines, all of them have deployment server set, and were visible in Forwarder Management. But in some time all of them disappeared from FM and are appearing from time to time there. I have tried to delete $SPLUNK_HOME/etc/instance.cfg on several forwarders and restarted them but problem was not fixed. Any ideas how to fix it and what can cause such strange behavior? Regards, Eugene

Gene · ‎09-03-2021

Thank you for the reply, but actually I am interested whether data replication will work or not 🙂

Gene · ‎09-02-2021

Hello Splunkers. I have a question: we are now moving from old servers to new ones. We had 5 indexers, not clustered and now we are going to have 3 indexers. We want to move all indexed data to new instances. I know the procedure of moving data, but I have an idea on how to make this process easier. Maybe you have tried this solution and know that it will or won't work. The idea is to set data replication from e.g. OldIDX1 => NewIdx1, OldIDX2=>NewIdx2, OLDIDX3,4,5=>NewIdx3. Can you please advise whether such 'solution' or 'Workaround' will work or this needs to be tested before? With best Regards, Gene

Gene · ‎08-12-2021

Nice promotion of Cribl 🙂 I have heard only good things about it, will need to check. Good luck and happy splunking!

Gene · ‎07-21-2021

Dear Splunkers, can you please advise or direct my to right place on following question: we need to send notification to collaborators when any changes are done to some investigation. Is there possibility to create e.g. alert or there is a build-in functionality to notify users when someone updates investigation with their finding? Thanks in advance!

Gene · ‎07-06-2021

Speed is e.g. when user connected from London and next time from China - in this field you can see with what speed user was traveling. This can be very suspicious in case user in 5 minutes did so. 🙂 distance is in miles but you can recalculate for your needs.

Gene · ‎07-06-2021

Your search | eventstats dc(src) as src_count by user | search src_count>1 | sort 0 + _time | iplocation src | where isnotnull(lat) AND isnotnull(lon) | streamstats window=2 global=false earliest(lat) as prev_lat, earliest(lon) as prev_lon, earliest(_time) as prev_time, earliest(src) as prev_src, earliest(City) as prev_city, earliest(Country) as prev_country, earliest(app) as prev_app by user | where (src != prev_src) | eval lat1_r=((lat * 3.14159265358) / 180), lat2_r=((prev_lat * 3.14159265358) / 180), delta=(((prev_lon - lon) * 3.14159265358) / 180), distance=(3959 * acos(((sin(lat1_r) * sin(lat2_r)) + ((cos(lat1_r) * cos(lat2_r)) * cos(delta))))), distance=round(distance,2) | fields - lat1_r, lat2_r, long1_r, long2_r, delta | eval time_diff=if((('_time' - prev_time) == 0),1,('_time' - prev_time)), speed=round(((distance * 3600) / time_diff),2) | eval prev_time=strftime(prev_time,"%Y-%m-%d %H:%M:%S") | table user, src, _time, City, Country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed Hope that will help. Thanks, Gene

Gene · ‎07-06-2021

Why don't you use app\addon for PaloAlto? It extracts fields without problems. Also according to your props.conf - sourcetype recognition is commented, so looks like it happens somewhere else. #TRANSFORMS-sourcetype = pan_traffic You can also try to download application and check config files there (easiest way) - so you will have some clue on how to modify your configs or copy them to your system. Thank, Gene

Gene · ‎07-06-2021

Hello all, I will update my question with example we have events id| sessionID | dl_max (numeric value with time to process event)| other not needed fields num | num| num what I want to achieve after search SessionID | dl_max | threshold | lastLevel | stateLevel 1 | 100 | 180 | 0 | 0 2 | 190 | 180 | 0 | 1 3 | 200 | 180 |1 | 2 4 | 220 | 180 | 2| 3 5 |160 | 180 |3 | 2 I would really appreciate your help.

Posts	31
Solutions	3
Karma Given	9
Karma Received	3
Member Since	‎06-08-2021

Online Status	Offline
Date Last Visited	‎05-21-2024 07:16 AM

Splunk Resilient integration issue

Why are UF's are disappearing from ForwarderManage...

Copy index data between different, not connected i...

How to notify collaborators when some changes are ...

Need help to create alert for a huge number of eve...

WIndows Active Directory sourcetypes

Filtering PaloAlto events

Re: UF's are disappearing from ForwarderManagement

Re: Add Salesforce Account- "Error occurred while ...

Re: Add Salesforce Account- "Error occurred while ...

Re: Notify collaborators when some changes are don...

Splunk Resilient integration issue

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Re: UF's are disappearing from ForwarderManagement

Why are UF's are disappearing from ForwarderManage...

Re: Copy index data between different, not connect...

Copy index data between different, not connected i...

Re: Process AWS VPC Flow Logs before indexing.

How to notify collaborators when some changes are ...

Re: Distance between two or more Geolocations (Lat...

Re: Distance between two or more Geolocations (Lat...

Re: index time extraction not working

Re: Need help to create alert for a huge number of...