When you run the command "netsh wlan show wlanreport", it does not only generate a HTML report, but also a xml report. This is good because the HTML report is intended for human consumption so Splunk will not be happy with it. You can instead index the XML file. The XML file is at: C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.xml To set up Splunk to generate and index this file once per hour, you need 3 configuration files: 1) A props.conf file on your indexer machine(s) # Put this in /opt/splunk/etc/apps/<yourappname>/local/props.conf [WlanReport] maxDist = 170 SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = <?xml version TIME_PREFIX = ReportDate> 2) A inputs.conf file on your forwarder machine(s) # Put this in /opt/splunkforwarder/etc/apps/<yourdeploymentappname>/local/inputs.conf [monitor://C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.xml] index=main sourcetype=WlanReport disabled = 0 initCrcLength = 256 # You can use a scripted input to run the command once per X seconds specified by the interval [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\<yourdeploymentappname>\bin\scripts\wlanreport.bat] interval = 3600 disabled = 0 # (I have trouble getting it to work with a relative path to the script) 3) The script file on your forwarder machine(s): # Put this in /opt/splunk/etc/apps/<yourdeploymentappname>/bin/wlanreport.bat @echo off netsh wlan show wlanreport   You will then have events coming in containing the XML file contents, every hour. ... View more

That should be doable. Does the other product have documentation describing the format in which it expects to receive the lookup? You should be able then to use SPL to convert the lookup into that format, in one or more fields, then send it using the POST HTTP alert action. ... View more

Can you give more information about this? Is this function part of a library, or app, or base Splunk functionality? ... View more

Yes, this is a security recommendation added recently. As the alert suggests, you can add email domains to your allowedDomainList by going to Server Settings > Email Settings > Email Domains. For example, if you want email alerts to only go to your company email addresses, then you can add your company domain there. This will restrict your email alerts so that users cannot accidentally or maliciously send data to unauthorized email domains. ... View more

I assume you are using compatible versions of all the components. If not then ensure they are at the right versions. ( https://docs.splunk.com/Documentation/DSDL/5.1.2/User/InstallDSDL ) DSDL - 5.1.2 MLTK - 5.4.0 PSC - 3.1.0, 4.1.0, or 4.1.2 Splunk - 8.1.x+ Another test you can do is to try connecting to your docker container outside of Splunk to see if the issue is due to restrictions on accessing localhost. ... View more

Is there any pattern between the ticket type and the values appearing? E.g. does the Customer value always appear in Normal Tickets but never in Error Tickets? Or does it look random? Also when you say that "In Splunk, it is confirmed that the value exists", can you say it definitely exists for all records, even for the tickets that say it doesn't exist? Try running your alert search, but looking for rows where the field does not have a value. <yoursearch> | search NOT Client=* ... View more

It seems that your alert job is successfully running. When you say "the test email was successful", do you mean a test email from Splunk or from a different interface? If it was not Splunk that sent the test email, could you test it with a search like this? It should either send you a simple test email or give you errors indicating what is going wrong: | makeresults | sendemail to="<youremailaddress>" subject="test splunk email" ... View more

Ultimately Splunk needs a date to know where to file your event. If the date is missing from the logs, then you need to supply or assume it from somewhere else. E.g. if Splunk sees the time "17:22:29.875", then do you want Splunk to assume that the date is the day of indexing? So if yesterday, then the full timestamp would be 2024-30-11 17:22:29.875 ... View more

According to the docs, you should use the sourcetype based on the configured event hub. Select the source type based on the configured Event Hub. Supported source types are mscs:azure:eventhub, azure:monitor:aad, azure:monitor:resource and azure:monitor:activity. The default sourcetype is mscs:azure:eventhub https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Configureeventhubs/ It seems that this add-on contains a props.conf stanza for the sourcetype "ms:o365:management" to CIM-normalize data from that sourcetype, but it does not contain any inputs.conf or scripts in bin which pull in the data. It is not clear why it is bundled that way. I would expect this CIM-normalizing config to be bundled in an add-on which also pulls the ms:o365:management data.   ... View more

I am curious about this, could you say which TA is trying to initialize the modular input even if the inputs.conf stanzas are disabled? ... View more

Does it work you run the script using the debugger, but uncheck the checkbox that says "Run as current user"? Also if I understand correctly, you are not using the SOAR winRM (Windows Remote Management) app, but you are instead using a different app to trigger a script, or using a custom function that implements WinRM communication? ... View more

Probably the cleanest way to do this is as @tscroggins suggested: Make a browser extension that changes the interface. Another workaround would be to ignore the app drop-down menu completely and instead make a navigation menu in your apps which has links to the various app versions and supports multi-drop-down. It may be cumbersome to maintain but it will look better. ... View more

If I understand correctly, you have a windows system with a logfile that does not have a long log retention time, so you cannot use the log file to look back very far, but you need to be able to look further back in time. This sounds like a straightforward use case for the Splunk forwarder. If you install the forwarder on the machine, then set up an input configuration to monitor that logfile, then the forwarder will send the log data to the Splunk indexers where it will be indexed and stored for longer times. ... View more

It might be that they forgot it or didn't consider it important for the primary use case. This add-on is Splunk supported, so if you have a support contract then you could reach out to Splunk support. ... View more

Can you run btool on the machine as the splunk user to make sure that the server_pkcs1.pem certificate is indeed the one used by splunk? /opt/splunk/bin/splunk btool server list sslConfig  Look for the serverCert variable ... View more

Another thing to check would be if Splunk is freezing buckets because they are older than are allowed by frozenTimePeriodInSecs. If the evtx data is older than your index retention policy then Splunk will index and then freeze them. Do you see any _internal logs indicating freezing buckets for your index that should contain the evtx data? (replace <yourindex> with your index name below) index=_internal source="/opt/splunk/var/log/splunk/splunkd.log" sourcetype=splunkd component=BucketMover bkt="'/opt/splunk/var/lib/splunk/<yourindex>*" freeze   ... View more

You can use the python+pip installation in the splunk bin directory to check the module version: /opt/splunk/bin/python -m pip freeze | grep -i cherrypy   ... View more

It uses the formula described in this article: https://docs.splunk.com/Documentation/ITSI/4.19.1/SI/KPIImportance#How_service_health_scores_are_calculated The health score calculation is based on the current severity level of service KPIs (Critical, High, Medium, Low, and Normal) and the weighted average of the importance values of all KPIs in a service. ... View more

Can you share your command used to install it via CLI? Also I assume you are running with Administrator privileges when installing. ... View more

That connector is for Splunk SOAR, the SOAR product offered by Splunk. It will not work with Splunk Enterprise, the SIEM product offered by Splunk. Currently it seems the go-to way to get intune logs into Splunk is to send them to a Microsoft Event Hub, and then use the Splunk Add-on for Microsoft Cloud Services to ingest them into Splunk. https://splunkbase.splunk.com/app/3110 ... View more

You could use the addinfo command then use the info_min_time field to contain the epoch time of your earliest time boundary in your time picker: <your search> | addinfo | eval _time = info_min_time ... View more

I also had this problem and managed to get the inputs page to load by changing the locale, specifically from en-US to en-GB.   https://myserver.com:8000/en-US/app -> https://myserver.com:8000/en-GB/app Not sure if that fixes it on your end but its worth a try. ... View more

Se quiser simplesmente efetuar uma busca de emprego e obter os resultados de uma só vez, em seguida, envie o seu pedido HTTP para https://edp.splunkcloud.com:8089/services/search/v2/jobs/export Isto funciona se o seu busca de emprego não demorar muito tempo. Se a sua busca de emprego demorar muito tempo, a ligação pode esgotar-se. Se isto não funcionar, então terá de enviar a busca de emprego e obter um SID como está a fazer atualmente. Quando a busca de emprego estiver concluída, é necessário enviar o pedido HTTP para https://edp.splunkcloud.com:8089/search/jobs/{search_id}/results para obter os resultados ... View more

You probably want the Splunk Add on for Microsoft Azure (https://splunkbase.splunk.com/app/3757) There are set-up instructions described at https://github.com/splunk/splunk-add-on-microsoft-azure/wiki (see the sections on Configuration) on the right. ... View more