This looks like it would work. If you're not quite sure and you want to make sure it is correct before the data goes into the index, then you could set up a sandbox index and use crcSalt to stop the logs from being registered as indexed already. In terms of billing, you would be paying for all logs, sandboxed or not, but it would avoid the annoyance of deleting wrongly-indexed data in your production indexes. E.g. [monitor://D:\Exchange Server\TransportRoles\Logs\*\ProtocolLog\SmtpReceive] whitelist=\.log$|\.LOG$ time_before_close = 0 sourcetype=MSExchange:2019:SmtpReceive queue=parsingQueue index=sandbox disabled=false crcSalt = "testing" (then remove or modify the crcSalt when the logs look good in the sandbox and are ready for production.) ... View more

Indeed I also cannot find a direct statement in the docs about this. I would assume that SOAR falls back to the community license, but I have never seen a SOAR license expire on a machine.  You could submit this question as feedback at the bottom of the docs page for the SOAR license, then they may add this information in a future version ... View more

Usually people safelist the SplunkForwarder service and the entire SplunkForwarder directory. You could safelist individual services and apps but you may end up spending lots of time playing whack-a-mole. You may be able to look through the community forums and Splunk Slack usergroup for your particular EDR solution to see if others have specific tips applying to that EDR.  ... View more

What makes you think it may be the wrong algorithm for your use case? ... View more

You could calculate the current hour of the alert execution, then adjust the threshold at the end. <mySearch> | bin _time span=1m | stats avg(msg.DurationMs) AS AvgDuration by _time, msg.Service | eval hour = strftime(now(),"%H") | where (AvgDuration > 1000 and hour >= 8 and hour < 17) or (AvgDuration > 500 AND (hour < 8 OR hour >= 17)) ... View more

Try the API: | rest "/servicesNS/-/-/saved/searches" splunk_server=* | regex search="index=\*" | table title search disabled author eai:acl.app ... View more

The targeted server/endpoint for integration with this app is the machine that you would like to run commands on. The server/endpoint itself does not need to be integrated into SOAR, but rather SOAR needs credentials/certificates/tickets to authenticate with the winRM service on the target server/endpoint. ... View more

This app is listed as "Developer Supported", which means you may have more success by directly contacting the developer to ask if they plan to add the retrieval of archive events to future releases. Email Support email: support@mimecast.com Contact Notes For technical support, visit https://community.mimecast.com/s/contactsupport ... View more

Not directly in the web UI, but you can set the number of page entries by changing the URL parameters. Go to the "Events" queue, then set the page size using the dropdown to any value other than the default. You will then see your URL look like: https://yoursoar.com/browse?page=1&per_page=25&filter=new_events&status=new You can then change per_page=25 to any number. For 100 entries, set per_page=100. You can do this with Playbooks, Events, and Cases. ... View more

Can you paste a copy of your original event in a code sample format? Perhaps one of the double-quotes is wrong. ... View more

Could you log in as the Splunk user on your indexer and then run btool for the stanzas relating the TLS-secured forwarding? /opt/splunk/bin/splunk btool inputs list SSL /opt/splunk/bin/splunk btool inputs list splunktcp-ssl /opt/splunk/bin/splunk btool server list sslConfig Make sure that the settings are set according to the instructions in the article. If they are the wrong values, then add --debug to the btool commands to find the file which is setting the command. If there are no problems there, then do you find specific complaints in the splunkd log of the forwarder? E.g. "Invalid certificate", or does the connection time out? Have you been able to forward logs, even _internal logs, before setting up TLS? ... View more

When you press the "New Token" button, then do you see the "New Token" menu which contains the fields: User, Audience, Expiration, Not Before, and then a field for "Token" which has the warning that the token will appear there only once upon creation? When you press "Create", then the "Token" field will contain the token itself, not the token ID. In the Tokens page, you will see the tokens listed, and the first column will be their token ID ... View more

It is possible to use props.conf settings on your indexer machines to pre-process the JSON into distinct events for each transaction, but I will assume that you instead have that one json object as a single event in Splunk. You can then use the following search: <Your search for finding the json event> ``` Chop off the first and last brackets ``` | rex field=_raw mode=sed "s/^{//" | rex field=_raw mode=sed "s/}$//" ``` Add a "SplitHere" keyword to target with a makemv command ``` | rex field=_raw mode=sed "s/},/},SPLITHERE/g" max_match=99 ``` Remove the Transaction1 etc. labels for each sub-object ``` | rex field=_raw mode=sed "s/\s*\"Transaction\d*\"\s:\s//g" max_match=99 ``` To avoid making _raw a multivalue lets eval it to the "a" field ``` | eval a = _raw ``` Split 'a' into multiple values and table it ``` | makemv a delim=",SPLITHERE" | mvexpand a | table a ``` Extract the key values for each json object ``` | spath input=a ``` Filter to desired fields and make it into final table with renaming and rounding ``` | table transaction pct2ResTime | rename transaction as "Transaction Name" | eval pct2ResTime = round(pct2ResTime) ... View more

At first glance I would suspect that the search filters for your roles are contradicting each other and filtering out all events. E.g. if you have the following roles with search filters: ROLE A - (index=index1 sourcetype=something) ROLE B - (index=index2 sourcetype=something) Then if you have role A and B, then Splunk will force you to search with "(index=index1 sourcetype=something) (index=index2 sourcetype=something)" which will retrieve 0 events because none exist in both index1 and index2 at the same time. Are you able to post your sanitized search filters to look for contradictory filters? ... View more

Are you absolutely sure that your forwarded events are all raw_event and not rendered_event? I had this issue where my event collector was forwarding mixed logs. You must check the event collector and make sure all forwarded events are of the same format. ... View more

Not by lowering the fonts, but by using special unicode characters that look like ampersands but are not treated as ampersands. Try copying and pasting the ampersand-like characters from my post. ... View more

I'm not sure if that URL is correctly written in your post, but the 8000 is a port, not a part of the path. E.g. "https://my_sh:8000/saml/logout" If that is not the issue, could you try searching your internal logs for keywords like "Saml" or "samlresponse"? Perhaps there will be a more detailed error message. index=_internal SamlResponse   ... View more

When you run the command "netsh wlan show wlanreport", it does not only generate a HTML report, but also a xml report. This is good because the HTML report is intended for human consumption so Splunk will not be happy with it. You can instead index the XML file. The XML file is at: C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.xml To set up Splunk to generate and index this file once per hour, you need 3 configuration files: 1) A props.conf file on your indexer machine(s) # Put this in /opt/splunk/etc/apps/<yourappname>/local/props.conf [WlanReport] maxDist = 170 SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = <?xml version TIME_PREFIX = ReportDate> 2) A inputs.conf file on your forwarder machine(s) # Put this in /opt/splunkforwarder/etc/apps/<yourdeploymentappname>/local/inputs.conf [monitor://C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.xml] index=main sourcetype=WlanReport disabled = 0 initCrcLength = 256 # You can use a scripted input to run the command once per X seconds specified by the interval [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\<yourdeploymentappname>\bin\scripts\wlanreport.bat] interval = 3600 disabled = 0 # (I have trouble getting it to work with a relative path to the script) 3) The script file on your forwarder machine(s): # Put this in /opt/splunk/etc/apps/<yourdeploymentappname>/bin/wlanreport.bat @echo off netsh wlan show wlanreport   You will then have events coming in containing the XML file contents, every hour. ... View more

That should be doable. Does the other product have documentation describing the format in which it expects to receive the lookup? You should be able then to use SPL to convert the lookup into that format, in one or more fields, then send it using the POST HTTP alert action. ... View more

Can you give more information about this? Is this function part of a library, or app, or base Splunk functionality? ... View more

Yes, this is a security recommendation added recently. As the alert suggests, you can add email domains to your allowedDomainList by going to Server Settings > Email Settings > Email Domains. For example, if you want email alerts to only go to your company email addresses, then you can add your company domain there. This will restrict your email alerts so that users cannot accidentally or maliciously send data to unauthorized email domains. ... View more

I assume you are using compatible versions of all the components. If not then ensure they are at the right versions. ( https://docs.splunk.com/Documentation/DSDL/5.1.2/User/InstallDSDL ) DSDL - 5.1.2 MLTK - 5.4.0 PSC - 3.1.0, 4.1.0, or 4.1.2 Splunk - 8.1.x+ Another test you can do is to try connecting to your docker container outside of Splunk to see if the issue is due to restrictions on accessing localhost. ... View more

Is there any pattern between the ticket type and the values appearing? E.g. does the Customer value always appear in Normal Tickets but never in Error Tickets? Or does it look random? Also when you say that "In Splunk, it is confirmed that the value exists", can you say it definitely exists for all records, even for the tickets that say it doesn't exist? Try running your alert search, but looking for rows where the field does not have a value. <yoursearch> | search NOT Client=* ... View more