We are trying to configure event monitoring for Security Event ID 4624 (successful login) and Event ID 4625 (unsuccessful login) for an Account. We have created the app with the below stanza in inputs.conf file   [WinEventLog://Security] index = wineventlog sourcetype=Security:AD_Sec_entmon disabled = 0 start_from = oldest current_only = 1 evt_resolve_ad_obj = 1 checkpointInterval = 300 whitelist = EventCode="4624|4625" #renderXml=false    However, there is no data though the app has been successfully deployed. Please assist me on this issue. ... View more

Please help me to extract multiple values from one single value.   ... View more

Hi, Please help me in extracting multivalue fields from email body logs: LOG: "Computer Name","Patch List Name","Compliance Status","Patch List Name1","Compliance Status1","OS Type1" "XXXX.emea.intra","ACN - Windows Server - PL - Up to Oct24","Compliant","[ACN - Windows Server - PL - Up to Aug24] + [ACN - Windows Server - PL - Sep24]","Compliant","Windows" "XXXX.na.intra","ACN - Windows Server - PL - Up to Oct24","Compliant","[ACN - Windows Server - PL - Up to Aug24] + [ACN - Windows Server - PL - Sep24]","Compliant","Windows" Fields i want to extract are these: "Computer Name","Patch List Name","Compliance Status","Patch List Name1","Compliance Status1","OS Type1" I have applied rex to bring out all the fields  The rex is giving me total number of 3131 computer_names but when i am using mvexpand command to expand in into multiple rows , it is giving me only 1500 results not sure why rest are getting truncated. Attaching the search query and snippet for reference: index=mail "*tanium*" |spath=body |rex field=body max_match=0 "\"(?<Computer_name>.*)\",\"ACN" |rex field=body max_match=0 "\"(?<Computer_name1>.*)\",\"\[n" |rex field=Computer_name1 max_match=0 "(?<Computer_name2>.*)\",\"\[n" |eval Computer_name=mvappend(Computer_name,Computer_name2)|table Computer_name |dedup Computer_name | mvexpand Computer_name | makemv Computer_name delim="," index=mail "*tanium*" |spath=body |rex field=body max_match=0 "\"(?<Computer_name>.*)\",\"ACN" |rex field=body max_match=0 "\"(?<Computer_name1>.*)\",\"\[n" |rex field=Computer_name1 max_match=0 "(?<Computer_name2>.*)\",\"\[n" |eval Computer_name=mvappend(Computer_name,Computer_name2) |rex field=body max_match=0 "\,(?<Patch_List_Name1>.*)\"\[" |rex field=Patch_List_Name1 max_match=0 "\"(?<Patch_List_Name>.*)\",\"" |rex field=Patch_List_Name1 max_match=0 "\",\""(?<Compliance_status>.*)\" |table Computer_name Patch_List_Name Compliance_status |dedup Computer_name Patch_List_Name Compliance_status | eval tagged=mvzip(Computer_name,Patch_List_Name) | eval tagged=mvzip(tagged,Compliance_status) | mvexpand tagged | makemv tagged delim="," | eval Computer_name=mvindex(tagged,0) | eval Patch_List_Name=mvindex(tagged,1) |eval Compliance_status=mvindex(tagged,-1) |table Computer_name Patch_List_Name Compliance_status       ... View more

Hi Splunkers, I am trying to configure rest api monitoring via splunk add-on builder but while configuring when i am trying to test the result i am receiving SSL error. Splunk-Add-on Builder Version:4.3.0 Splunk Enterprise Version:9.1.1 What could be done to mitigate this SSL error? Awaiting quick help and response Pasting the error herewith: 2024-09-16 15:28:49,569 - test_rest_api - [ERROR] - [test] HTTPError reason=HTTP Error HTTPSConnectionPool(host='endpoints.office.com', port=443): Max retries exceeded with url: /version?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1106)'))) when sending request to url=https://endpoints.office.com/version?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7 method=GET Traceback (most recent call last): File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/urllib3/connectionpool.py", line 722, in urlopen chunked=chunked, File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/urllib3/connectionpool.py", line 404, in _make_request self._validate_conn(conn) File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/urllib3/connectionpool.py", line 1060, in _validate_conn conn.connect() File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/urllib3/connection.py", line 429, in connect tls_in_tls=tls_in_tls, File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/urllib3/util/ssl_.py", line 450, in ssl_wrap_socket sock, context, tls_in_tls, server_hostname=server_hostname File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl return ssl_context.wrap_socket(sock, server_hostname=server_hostname) File "/splunk/lib/python3.7/ssl.py", line 428, in wrap_socket session=session File "/splunk/lib/python3.7/ssl.py", line 878, in _create self.do_handshake() File "/splunk/lib/python3.7/ssl.py", line 1147, in do_handshake self._sslobj.do_handshake() ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1106) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/requests/adapters.py", line 497, in send chunked=chunked, File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/urllib3/connectionpool.py", line 802, in urlopen method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2] File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/urllib3/util/retry.py", line 594, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='endpoints.office.com', port=443): Max retries exceeded with url: /version?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1106)'))) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/cloudconnectlib/core/http.py", line 230, in _retry_send_request_if_needed uri=uri, body=body, method=method, headers=headers File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/cloudconnectlib/core/http.py", line 219, in _send_internal verify=self.requests_verify, File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/requests/sessions.py", line 589, in request resp = self.send(prep, **send_kwargs) File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/requests/sessions.py", line 703, in send r = adapter.send(request, **kwargs) File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/requests/adapters.py", line 517, in send raise SSLError(e, request=request) requests.exceptions.SSLError: HTTPSConnectionPool(host='endpoints.office.com', port=443): Max retries exceeded with url: /version?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1106)'))) The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/cloudconnectlib/core/engine.py", line 308, in _send_request response = self._client.send(request) File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/cloudconnectlib/core/http.py", line 296, in send url, request.method, request.headers, request.body File "/splunk/etc/apps/TA-o365_rest_api/bin/ta_o365_rest_api/aob_py3/cloudconnectlib/core/http.py", line 243, in _retry_send_request_if_needed raise HTTPError(f"HTTP Error {err}") from err cloudconnectlib.core.exceptions.HTTPError: HTTP Error HTTPSConnectionPool(host='endpoints.office.com', port=443): Max retries exceeded with url: /version?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1106)'))) 2024-09-16 15:28:49,570 - test_rest_api - [INFO] - [test] This job need to be terminated. 2024-09-16 15:28:49,570 - test_rest_api - [INFO] - [test] Job processing finished 2024-09-16 15:28:49,571 - test_rest_api - [INFO] - [test] 1 job(s) process finished 2024-09-16 15:28:49,571 - test_rest_api - [INFO] - [test] Engine executing finished  ... View more

We want to monitor and poll data from REST APIs and index the responses in Splunk. We know that could be achieved by the Splunk base provided app REST API Modular Input but since it's a developer supported paid service application, we wanted to know is there any other alternative way to monitor the same in Splunk enterprise. A quick response is highly appreciated.  ... View more

I have a dashboard which gives the below error at user end but when i open the dashboard i dont see any error at my end and it perfectly runs fine with the proper result Error in 'lookup' command: Could not construct lookup 'EventCodes, EventCode, LogName, OUTPUTNEW, desc'. See search.log for more details. Eventtype 'msad-rep-errors' does not exist or is disabled. Please help me how to fix this issue.   ... View more

Hi Everyone,Could you please help me break below events  Expected Events: Subject : ABCD FriendlyName : ABCD Issuer : ABCD Thumbprint : 3CBB2CACD16 NotAfter : 2025 Expires in (Days) : 0 ForSplunk : Break Events which is getting received: NotAfter : 2025 Expires in (Days) : 0 ForSplunk : Break Subject : ABCD FriendlyName :ABCD Issuer : ABCD Thumbprint :3CBB2CACD16 Subject : ABCD FriendlyName :ABCD Issuer : ABCD Thumbprint : 3CBB2CACD16 NotAfter : 2025 Expires in (Days) : 68 ForSplunk : Break I want my Events to break after FOR SPLUNK : BREAK but its creating issue for some of the events and not for all.I dont know why its working in some cases and not working in some of the cases.   This is there in my props.conf [MY-SOURCETYPE] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = custom pulldown_type = 1 TIME_FORMAT = %Y-%m-%d_%H:%M:%S_%p SHOULD_LINEMERGE = true MUST_BREAK_AFTER = Break disabled = false ... View more