Hi Team, We are not able to see any custom created add-on using Add-on builder in Splunk HF. What is the issue?, how we can resolve this? ... View more

Hi All, We are observing high number of parsing issues on sourcetype= symantec:email:cloud:atp. We haven't done any changes in Add-on. Please suggest how to resolve this issue. how to identify exact which events are facing this issue and how to resolve it. Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Wed Jun 29 10:52:21 2022). Context: source=/opt/splunk/etc/apps/TA-symantec_email/bin/symantec_collect_atp.py|host=s|symantec:email:cloud:atp| 06-29-2022 10:53:30.862 +0000 WARN DateParserVerbose [27921 merging] - The TIME_FORMAT specified is matching timestamps (INVALID_TIME (1656499945449)) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=/opt/splunk/etc/apps/TA-symantec_email/bin/symantec_collect_atp.py|host=|symantec:email:cloud:atp| Please find the props.config file setting for symantec:email:cloud:atp     ... View more

Hi Team, We have been requested to integrate logs CloudWAN application logs using API key/token(Pull). Means Pull logs from CloudWan using API token But the issue is that CloudWAN API key has validity only 1 days so it is not possible generate API key on daily basis to pull the logs from CloudWAN. So we are looking any Automated Scripts or Method to generate API key and refresh data into SPlunk.     ... View more

Hi Team, I am getting  date and time format as "Created_time =1649576166225" in raw log we have to convert. Please help me convert in readable format for all logs. Need to do any changes in input level or anything please help me           ... View more

Hi Team, We have Splunk cloud in production environment like indexer and Search head now customer want UAT environment in On Premises(Indexer and Search head) as testing purpose. Purpose of the UAT environment is that we can test all log source onboarding, usecase development and testing in UAT environment first then forward it to Production Splunk cloud So my question are 1. Is there any challenges, issues and any dependency with respect to App, Add-Ons or any other if we have On premises ES in UAT environment  2.  What is exact difference between Splunk Cloud and Splunk ES On- premises Because we have Splunk cloud in productions environment and customer want Splunk ES on premises as UAT purpose.   ... View more

Hi Team, Any one has integrated below application with SPlunk if yes. Please suggest how Chromeleon- Chromatography Data System (CDS) software- Built with both the lab and IT in mind, this software delivers superior compliance tools, networking capabilities, instrument control, automation, and much more! Robotics DBC ... View more

Hi team, I am new to Splunk please help me here We have integrated one Algosec application with SPlunk Via Syslog method and collecting Audit logs Means successful login/ unsuccessful login to Algosec Application. In logs we are getting only Algosec application IP but not source IP(Which is actually trying to login). We have checked in AD logs based on username, target IP(Algosec IP) as well but not able see any information of source IP.  LDAP configuration is done on Algosec application So my question is which method is useful to get actual source IP 1. Could I get Source IP in Ldap audit logs via event viewer. if yes then how I can forward this logs to Splunk from Event viewer Windows Event Viewer > Applications and Services Logs > Directory Service https://www.manageengine.com/products/active-directory-audit/how-to/images/how-to-audit-ldap-queries-active-directory-2.png 2. Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)- This Ad-on is useful to get LDAP audit logs to find out source IP https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.3/User/AbouttheSplunkSupportingAdd-onforActiveDirectory ... View more