Hi   I'm installing Splunk UBA and I got the next error:   waiting on impala containerized service to come up Running CaspidaCleanup, resetting rules Cleaning up node domain.com checking if zookeeper is reachable at: domain.com:2181 zookeeper reachable at: domain.com:2181 checking if postgres is reachable at: domain.com:5432 postgres server reachable at: domain.com:5432 checking if impala is reachable at: jdbc:impala://domain.com:21050/;auth=noSasl impala jdbc server at:jdbc:impala://domain.com:21050/;auth=noSasl not reachable, aborting required services not up, aborting cleanup CaspidaCleanup failed, exiting   There are not logs from impala [caspida@ubasplunk ~]$ ls /var/log/impala/ [caspida@ubasplunk ~]$ ls /var/log/impala/     The docker container is running ant the port is map and the 21050 port is open [caspida@ubasplunk ~]$ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 7d198d890b13 domain.com:5000/impala:latest "/bin/bash -c './imp…" 4 minutes ago Up 4 minutes 0.0.0.0:21000->21000/tcp, :::21000->21000/tcp, 0.0.0.0:21050->21050/tcp, :::21050->21050/tcp, 0.0.0.0:24000->24000/tcp, :::24000->24000/tcp, 0.0.0.0:25000->25000/tcp, :::25000->25000/tcp, 0.0.0.0:25010->25010/tcp, :::25010->25010/tcp, 0.0.0.0:25020->25020/tcp, :::25020->25020/tcp, 0.0.0.0:26000->26000/tcp, :::26000->26000/tcp impala 15d899b79ed2 07655ddf2eeb "/dashboard --insecu…" 6 minutes ago Up 6 minutes     Can you helpe to resolve the issue? ... View more

Hello colleagues! Have any of you integrated Cisco Talos as an intelligence source for Splunk Enterprise Security? Can you tell me the best way to do this? ... View more

Hello partners I request your kind support as I intend to activate the Linux ESCU correlations, however these do not work well because the datamodels are not complete, I know they are necessary, but my observation is that the Linux events do not contain all the values ​​necessary to fill the datamodel. So my question to the community is the following: What audit, messages or syslog rules must be active for the correct collection of events? ... View more

Hi friends.   I've followed de path to use UniversarForwarder app from my splunk cloud enviromen. But i have the next message: The TCP output processor has paused the data flow. Forwarding to host_dest=inputs1.XXXX.splunkcloud.com inside output group splunkcloud_ from host_src=YYYYYY has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. Learn more.   I've tested the communications to splunk cloud   splunkcloud.com:9997 splunkcloud.com:8000 splunkcloud.com:8089   And all are OK. My heavy forwarder is now skipping data. Is there something else I clould check out?     ... View more