Hi team,   Need help if anyone faced issues on phantom playbooks not processing events after upgrade from 5.0.1v to 5.1.0v. Thanks, Sharada ... View more

Hello All, We are planning to upgrade phantom platform from 4.10.7 to 5.0.1 version. Can you please let us know the known issues if anyone has upgraded to 5.0.1 version. Any links to go through would really help. Thanks, Sharada ... View more

Hi All,   We are receiving below timestamp  issues, 0000 WARN DateParserVerbose [104706 merging_0] - Accepted time format has changed ((?i)(?<![\d\.])(20\d\d)([-/])([01]?\d)\2([012]?\d|3[01])\s+([012]?\d):([0-6]?\d):([0-6]?\d)\s*(?i)((?:(?:UT|UTC|GMT(?![+-])|CET|CEST|CETDST|MET|MEST|METDST|MEZ|MESZ|EET|EEST|EETDST|WET|WEST|WETDST|MSK|MSD|IST|JST|KST|HKT|AST|ADT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|CAST|CADT|EAST|EADT|WAST|WADT|Z)|(?:GMT)?[+-]\d\d?:?(?:\d\d)?)(?!\w))?), possibly indicating a problem in extracting timestamp 12-27-2021 14:33:04.972 +0000 WARN DateParserVerbose [104095 merging_0] - Accepted time format has changed ((?i)(?<![\w\.])(?i)(?i)(0?[1-9]|[12]\d|3[01])(?:st|nd|rd|th|[,\.;])?([\- /]) {0,2}(?i)(?:(?i)(?<![\d\w])(jan|\x{3127}\x{6708}|feb|\x{4E8C}\x{6708}|mar|\x{4E09}\x{6708}|apr|\x{56DB}\x{6708}|may|\x{4E94}\x{6708}|jun|\x{516D}\x{6708}|jul|\x{4E03}\x{6708}|aug|\x{516B}\x{6708}|sep|\x{4E5D}\x{6708}|oct|\x{5341}\x{6708}|nov|\x{5341}\x{3127}\x{6708}|dec|\x{5341}\x{4E8C}\x{6708})[a-z,\.;]*|(?i)(0?[1-9]|1[012])(?!:))\2 {0,2}(?i)(20\d\d|19\d\d|[9012]\d(?!\d))(?![\w\.])), possibly indicating a problem in extracting timestamps All the Linux servers that are sending logs to Splunk are in EST timezone and we are expecting the same timezone to be indexed at. But we are still seeing issues not able to identify which of the servers are causing timezone issues. Is there any other checks we need to perform to solve the above errors. Thanks, Sharada ... View more

Hi All, We have configures below stanza on SMB server(UF) and splunk forwarder to collect SMB logs, [WinEventLog://Microsoft-Windows-SMBServer/Audit] disabled = 0 start_from = oldest current_only = 0 index = wineventlog Can you please let us know if the above stanza worked for anyone to collect the logs or  share any working stanza is appreciated. TIA Sharada ... View more

Hi Team,   Wanted to enable SMB server audit logs in Splunk from UF or inputs.conf etc, can anyone please help with the configuration steps or any splunk docs for reference. Thanks in advance!! Thanks, Sharada Pandilla ... View more

Hi Team, Can you help me with splunk query which gives  me visualization for scheduled searches spiking top of the hour? Thanks, Sharada ... View more

Hi Splunkers,   I am having the below issue could you please help me to solve the issue. Here is my event 08-02-2021 20:46:39.852 +0000 WARN DateParserVerbose - Accepted time (Mon Aug 2 20:10:36 2021) is suspiciously far away from the previous event's time (Tue Aug 3 00:18:26 2021), but still accepted because it was extracted by the same pattern. TIME 8/2/21 10:35:55.489 AM EVENT 08-02-2021 10:35:55.489 -0400 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Mon Aug 2 10:35:53 2021). Here is my props.conf  [azure:prod] DATETIME_CONFIG = CURRENT TRUNCATE = 10000 MAX_TIMESTAMP_LOOKAHEAD = 128 ... View more

Hi Splunkers, I am facing the below time stamp issues. Could you please help me with this issue. 08-01-2021 22:49:25.563 -0400 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (800) characters of event. Defaulting to timestamp of previous event (Sun Aug 1 22:49:25 2021).   [props] TIME_FORMAT = %m-%d-%Y%H:%M:%S.%3Q SHOULD_LINEMERGE = False is_valid = True maxDist = 9999 BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = CURRENT LINE_BREAKER = ([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD = 800 NO_BINARY_CHECK = true category = Custom ... View more