Is your data being interpreted by Splunk as JSON? Try expanding the event fields and seeing if it automatically extracts the json fields. If not, you'll have to change the indexing of the event so it is read as a JSON object. Then you can use SPATH or the auto-extracted fields to get the desired values. ... View more

Yeah the app is not great at deduplicating the notables it sends to SOAR. Ideally you would want this app to run a search, find result with some key field X, then create only one container with one artifact containing that result. Subsequent searches in the app will create a new artifact in the same container, but this is unwanted. One way around this is to set up your generating search so that it appends the results to a whitelist which is used in later executions of the search to remove the results already seen. E.g. imagine you have a unique field of "id" in your results. You want only one container+artifact per value of "id". 1. Make a lookup containing one "id" column. E.g. search_whitelist.csv 2. Change your search to append and exclude ids: | <your search> | search NOT [| inputlookup search_whitelist.csv | table id] | outputlookup search_whitelist.csv append=true 3. (optional but recommended) - make another search which removes old entries from the search_whitelist.csv if it gets too big. E.g. | inputlookup search_whitelist.csv | sort - id | head 10000 | outputlookup search_whitelist.csv   ... View more

The Add-on for Cloudflare data app is best installed on a heavy forwarder, as it is managed using the web interface. On a heavy forwarder, install the app using Apps->"Manage Apps"->"Install app from file", then upload the file. You can then navigate to the app using the Apps dropdown in the upper-left, then selecting the app. On the upper left you can go to Configuration, then Add-on Settings, then enter your X-auth email and key for cloudflare. Then you can go to the Inputs menu on the upper left and press "Create New Input" (in the upper right). Then you can create inputs for various data types, specifying the index and interval of collecting the logs from the Cloudflare API. Once this is done, and if your heavy forwarder can connect to cloudflare, then it should start indexing logs in sourcetypes beginning with cloudflare:* e.g. index=<yourindex> sourcetype=cloudflare:* ... View more

It appears that the JAMF classic API uses the paths: https://server.name.here:8443/JSSResource https://server.name.here:8443/api While the JAMF Pro API uses the paths: https://server.name.here:8443/uapi There are mentions of the uapi endpoint in the file in the "JAMF Pro Add on for Splunk" app at /JAMF-Pro-addon-for-splunk/bin/uapiModels/devices.py and jamfpro.py in the same directory, so likely the app does use the Pro API as well as the classic API. However the code for jamfpro.py suggests that it uses basic authentication with username and password to obtain a bearer token, with no mention of Access Token, Client ID, or Client Secret. Thus it is likely the answer to your question about authentications is that the app only supports basic authentication.     class JamfPro: class JamfUAPIAuthToken(object): .... def get_token(self): url = self.server_url + 'api/v1/auth/token' logging.info("JSSAuthToken requesting new token") userpass = self._auth[0] + ':' + self._auth[1] encoded_u = base64.b64encode(userpass.encode()).decode() headers = {"Authorization": "Basic %s" % encoded_u} for key in self.extraHeaders: headers[key] = self.extraHeaders[key] response = self.helper.send_http_request(url="https://" + url, method="POST", headers=headers, use_proxy=self.useProxy) if response.status_code != 200: raise Exception self.unix_timestamp() + 60 self._set_token(response.json()['token'], self.unix_timestamp() + 60)   ... View more

You can list the users using the REST API, then sort them by the number of days since last successful login:   | rest /services/authentication/users splunk_server=local | table title email type last_successful_login | eval days_since_last_login = round((now() - last_successful_login)/86400,1) | sort - days_since_last_login   Then for each one, you can use the various REST apis for knowledge objects, listed at https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTREF/RESTaccess e.g. for field extractions:   | rest /services/data/props/extractions splunk_server=local | search eai:acl.owner = "<nameofinactiveuser>" | table attribute author eai:acl.app eai:acl.owner stanza title updated type value   Unfortunately there is no endpoint for "all knowledge objects", so you'll have to REST call for each separate type. EDIT: nvm richgalloway found one ... View more

If I understand correctly, you want an alert for every unique Ticket (id) value, but every unique Ticket (id) value will be throttled for 24 hours after it triggers an alert. You can accomplish this by setting the trigger conditions: Trigger alert when: Number of Results is greater than 0 Trigger: For each result Throttle: (checked) Suppress results containing field value: Ticket Suppress triggering for: 24 hours ... View more

The props.conf file should be on the machine that is parsing your logs. If your log path is UF->HF->Cloud, then likely the HF machine is the one doing the parsing, and it should have the props.conf file, not the UF. Also, keep in mind that the first capture group of LINE_BREAKER is discarded. It is intended to capture the filler characters that occur between distinct events. If you would like to keep "platform":"ArcodaSAT"} as part of the first event, then it should not be in a capture group. Try this: LINE_BREAKER = \"platform\"\:\"ArcodaSAT\"\}() For SHOULD_LINEMERGE, this would be better set as FALSE unless you would like events to be recombined to make bigger events. If your LINE_BREAKER above works well to separate distinct events, then SHOULD_LINEMERGE should be false SHOULD_LINEMERGE = false ... View more

In Splunk, the webhook Alert action accepts a single endpoint value to which to send the webhook. If you create an alert, then you can view it in Settings->"Searches, Reports, and Alerts", click the "Edit" dropdown, then click "Advanced Edit", then scroll down to the fields of "action.webhook". Here you can specify more settings for your webhook. As for sending a webhook for Akamai, do you have documentation describing what the webhook should look like? If I understand correctly, you would like Splunk to have an alert which sends a webhook to Akamai that contains an IP, from a field in the alert. ... View more

If you are using dashboard studio, then you should see a "Default value" field appear on the Configuration column when the text input (text filter) box is highlighted in edit mode. ... View more

You would have to tell Splunk how to split the events. You can do this by setting the LINE_BREAKER field in a props.conf file in an app in your indexers. If you could post a sample of your event (with sensitive data removed) and a rough description of your splunk setup (single machine or distributed?), then it would be easier to give you more specific pointers. ... View more

I'm sure you know already that the Universal Forwarder just forwards data from files, from event logs, or from scripts. Some example scenarios where you would want a heavy forwarder include: * You are collecting logs using apps like DBConnect, Salesforce, HTTP modular input, etc. (These apps tend to be managed using the web interface, so a heavy forwarder is better) * You would like to perform parsing operations on data before it is indexed. E.g. you might want to send certain data to one indexer cluster and other data to another indexer cluster. * You would like to collect events using the HTTP Event Collector (HEC), but you don't want to expose the HEC interface of your indexers. ... View more

They are being issued. For me it took two weeks to arrive, so the time varies. ... View more

When you say "seen in Splunk as json data which is not searchable", do you mean the data is not at all appearing in Splunk, or it is possible to use search to retrieve the logs but they do not extract fields? Splunk handles JSON logs straightforwardly so if the logs do reach splunk in proper JSON format then it should have no problem indexing the logs and even automatically extracting fields. ... View more

Try adding the globallimit= field to geostats. As in: | geostats globallimit=93 latfield=Lat longfield=Long count by Country   ... View more

You can go to Searches, Reports, and Alerts, then set the App to be Splunk Security Essentials. If you set the Owner to All, you can then see all of the included Searches in the app. If one of them is scheduled, you can set its time range and schedule, so that it will onboard data from long ago in a single swoop. Did you do anything in the app interface to activate the "onboarding background search?" ... View more

There is a troubleshooting guide here: https://splunk.github.io/splunk-connect-for-syslog/main/troubleshooting/troubleshoot_resources/ The guide describes how to to write the rawmsg to a file for both the working server and your non-working windows machine, to see if the messages are received the same. Once you confirm that the logs are being received the same, you can move to seeing why Splunk is not then indexing them.   ... View more

Are you sure it is supposed to go to the raw event collector at /services/collector/raw ? Unless I am mistaken, you need the export_raw option to be enabled to export raw data for that endpoint. Try running it with the endpoint set to: https://<host>:8088/services/collector ... View more

If I understand you correctly, you are exporting the results of a search, then importing it in another Splunk instance as new data? This would definitely alter the fields. The exporting of search results is not intended as a method to move data unchanged from one Splunk instance to another. Are you trying to import BOTS data or to package indexed data in a manner similar to the BOTS data? ... View more

We cannot tell what data is being stored in your "main" index. You'd have to describe what type of data it is, before asking the meaning of the field values. It would be helpful to have names of apps and reporting services, and then hopefully someone in the community will have experience with it. ... View more

You might find this blog post useful: https://www.splunk.com/en_us/blog/tips-and-tricks/protocol-data-inputs.html It describes the Protocol Data Inputs app (https://splunkbase.splunk.com/app/1901) that performs custom data handling and pre-processing of the received data before it gets indexed by Splunk. It should be possible with this app to write a custom data handler that will accept your ProtoBuf data. ... View more

Unfortunately this error does not give any reason _why_ the search head cannot connect to the manager node. If the stanza is exactly correct between the working search head and the non-working search head, then it could be a network connectivity issue or a firewall issue rather than a splunk issue. Do you see any errors in the _internal logs that may describe the reason why the search head was failing to connect? ... View more

Try setting it like this: [WinEventLog://Security] index = wineventlog sourcetype = WinEventLog:Security disabled = 0 whitelist = 0-6000 blacklist = 1,2,3,4 ... View more

The /export endpoint will dispatch a search and then retrieve the results when the search is completed. If the search takes a lot of time, then likely the request will time out. You can either make your search faster or you can use two endpoints, one where you dispatch the search and another endpoint where you later retrieve the results. To dispatch the search: curl -k -H 'Authorization: Splunk <your_token_here>' https://your_searchhead_here:8089/services/search/jobs -d search="search index=* | head 10 | table host" The above call will return you a search id (sid), which you'll need in the following call to retrieve the results: curl -k -H 'Authorization: Splunk <your_token_here>' https://your_searchhead_here:8089/services/search/<yoursidhere>/results Ref: https://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTsearches ... View more