About kn450

kn450

Hi everyone, I am facing an persistent issue with the Splunk Add-on for Phantom (`sendtophantom` modular action) when trying to forward events to Splunk SOAR. Despite multiple attempts to resolve it, the modular action log consistently throws a non-fatal-looking error during initialization: | makeresults | eval src_ip="123.45.66.77" | table src_ip | sendalert sendtophantom param.phantom_server="IRuser" param.sensitivity="amber" param.severity="low" param.label="events" 2026-11-03 10:30:56,483 log_level=INFO pid=4081989 tid=MainThread file=cim_actions.py:__init__:315 | Initializing modaction. search_name="" pid=4081989 2026-11-03 10:30:58,494 log_level=INFO pid=4081989 tid=MainThread file=cim_actions.py:message:462 | sendmodaction - worker="$HOSTNAME" signature="Invoking modular action" action_name="sendtophantom" sid="1793691055.1839" rid="0" app="search" user="admin" digest_mode="1" action_mode="adhoc" 2026-11-03 10:30:58,494 log_level=ERROR pid=4081989 tid=MainThread file=setup_util.py:log_error:138 | Global config JSON file not found! 2026-11-03 10:30:58,594 log_level=INFO pid=4081989 tid=MainThread file=cim_actions.py:message:462 | sendmodaction - worker="$HOSTNAME" signature="get_artifact_send_method duration=7ms" action_name="sendtophantom" sid="1793691055.1839" rid="0" app="search" user="admin" digest_mode="1" action_mode="adhoc" action_status="success" 2026-11-03 10:30:58,600 log_level=INFO pid=4081989 tid=MainThread file=cim_actions.py:message:462 | sendmodaction - worker="$HOSTNAME" signature="get_field_mapping duration=6ms" action_name="sendtophantom" sid="1793691055.1839" rid="0" app="search" user="admin" digest_mode="1" action_mode="adhoc" action_status="success" 2026-11-03 10:30:58,600 log_level=INFO pid=4081989 tid=MainThread file=cim_actions.py:message:462 | sendmodaction - worker="$HOSTNAME" signature="Total results found: 1" action_name="sendtophantom" sid="1793691055.1839" rid="0" app="search" user="admin" digest_mode="1" action_mode="adhoc" action_status="success" 2026-11-03 10:30:58,601 log_level=INFO pid=4081989 tid=MainThread file=cim_actions.py:message:462 | sendmodaction - worker="$HOSTNAME" signature="Running locally" action_name="sendtophantom" sid="1793691055.1839" rid="0" app="search" user="admin" digest_mode="1" action_mode="adhoc" action_status="success" 2026-11-03 10:30:58,601 log_level=INFO pid=4081989 tid=MainThread file=cim_actions.py:message:462 | sendmodaction - worker="$HOSTNAME" signature="Running action 'sendtophantom' to forward multiple events to 'IRuser'" action_name="sendtophantom" sid="1793691055.1839" rid="0" app="search" user="admin" digest_mode="1" action_mode="adhoc" action_status="success" 2026-11-03 10:30:59,760 log_level=INFO pid=4081989 tid=MainThread file=cim_actions.py:message:462 | sendmodaction - worker="$HOSTNAME" signature="verify_server duration=1158ms" action_name="sendtophantom" sid="1793691055.1839" rid="0" app="search" user="admin" digest_mode="1" action_mode="adhoc" action_status="success"

kn450 · ‎01-19-2026

Hi, I’m trying to use Splunk as a log aggregation solution, and eventually as a SIEM. I have three industrial plants that are completely air-gapped, with no permanent internet access. The idea is to deploy a syslog server at each plant to collect logs locally and then forward them to a central Splunk installation. Any component or software will be: downloaded or installed during a temporary internet connection (via a cellular modem), then moved into a fully air-gapped production environment. I’ve reviewed SC4S (Splunk Connect for Syslog) through the official Splunk documentation and several videos. In theory, it looks like a very powerful and well-designed solution. However, in practice, I find the documentation quite difficult to follow, especially when considering: an air-gapped environment, no internet connectivity, and very large log volumes (high EPS / high throughput). My main questions are: From a practical and low-complexity perspective: Is it better to use SC4S, or to simply deploy syslog-ng or rsyslog (open-source solutions) on Linux servers at each plant and forward logs to the central Splunk instance? Best deployment model for an air-gapped industrial environment: SC4S standalone at each site? Simple syslog collectors with forwarding? Which option is more stable and easier to operate long term? Given a preference for open-source solutions: Is relying on syslog-ng / rsyslog considered a professionally acceptable approach with Splunk? Or has SC4S effectively become the best practice that should not be avoided? From an operating system perspective: Which is better suited for handling very large volumes of log data? Ubuntu Server CentOS / Rocky Linux / AlmaLinux Which is more stable and easier to maintain in a 24/7 production environment? The end goal: A stable solution Simple to operate Capable of handling very large data volumes Suitable for air-gapped industrial environments Without introducing excessive operational complexity I’m trying to find a balance between simplicity and best practices. I want to use Splunk correctly, but at the same time avoid introducing operational complexity that exceeds the team’s current capabilities. Any advice or real-world experience would be greatly appreciated.

kn450 · ‎12-26-2025

Hello Splunk Community, I am facing an issue and would appreciate your guidance. Currently, I am sending threats (Notable Events) to Splunk SOAR using the Splunk App for SOAR Export. Previously, the threats were delivered to SOAR almost instantly (near real-time) without any noticeable delay. However, after installing Splunk Enterprise Security version 8.1, I started to experience a delay of approximately 10–15 minutes before the threats reach SOAR. Observations: System resources are sufficient: vCPU: 90 RAM: 60 GB After installing ES, there is a significant increase in CPU utilization, with multiple splunkd and python3.9 processes consuming high CPU, for example: %CPU %MEM COMMAND 165.0 4.3 splunkd 114.9 0.3 splunkd 72.6 0.2 splunkd 66.7 0.2 splunkd 66.0 0.2 splunkd 24.4 0.0 python3.9 Connectivity between Splunk and SOAR is healthy, with no connection errors. After restarting the Splunk platform, threats are sent quickly with no delay. After some uptime, the delay returns again. No configuration changes were made on the SOAR side. The only change in the environment was installing Splunk Enterprise Security 8.1. My questions: Is this behavior known in ES 8.1? Could any settings related to: Adaptive Response Notable Events pipeline Correlation Search Scheduler cause this delay? Which logs or metrics would you recommend checking to identify the root cause? Any guidance or similar experiences would be greatly appreciated. Thank you in advance

kn450 · ‎12-22-2025

Hello Splunk Community, I'm encountering an issue with a delay in sending threat data to Splunk SOAR. The delay is approximately 10-15 minutes. What's odd is that when I restart the platform, the threats are sent much faster, with no delay. However, the delay starts occurring again after some time. My environment has good resources, and there were no delays a few months ago. I’m unsure what might be causing this behavior, and I’d appreciate any insights or suggestions you may have. Additionally, if no solution is found, I’m considering reformatting the platform but would like to know if there's a way to do so without losing any data. Thank you in advance for your help!

kn450 · ‎12-09-2025

am using Splunk ES version 8 and the SOAR (Phantom) app version 4.3.26. I use sendtophantom to forward events to SOAR. The action always shows success in the Splunk logs, but events reach SOAR after about 8 minutes.The issue appeared suddenly; it was working fine before. Here are some observations from the logs: phantom_sendtophantom_modalert.log shows action_status="success" and sometimes long durations, e.g.: duration="549648" ms ≈ 9 minutes This roughly matches the 8-minute delay observed. phantom_forward_modalert.log and phantom_retry.log confirm the app version is 4.3.26 and the KV Store has no pending items. The delay seems to come from long processing time inside the modular action within Splunk, not from connectivity or network issues.

kn450 · ‎12-09-2025

am using Splunk ES version 8 and the SOAR (Phantom) app version 4.3.26. I use sendtophantom to forward events to SOAR. The action always shows success in the Splunk logs, but events reach SOAR after about 8 minutes.The issue appeared suddenly; it was working fine before. Here are some observations from the logs: phantom_sendtophantom_modalert.log shows action_status="success" and sometimes long durations, e.g.: duration="549648" ms ≈ 9 minutes This roughly matches the 8-minute delay observed. phantom_forward_modalert.log and phantom_retry.log confirm the app version is 4.3.26 and the KV Store has no pending items. The delay seems to come from long processing time inside the modular action within Splunk, not from connectivity or network issues.

kn450 · ‎12-09-2025

am using Splunk ES version 8 and the SOAR (Phantom) app version 4.3.26. I use sendtophantom to forward events to SOAR. The action always shows success in the Splunk logs, but events reach SOAR after about 8 minutes. The issue appeared suddenly; it was working fine before. Here are some observations from the logs: phantom_sendtophantom_modalert.log shows action_status="success" and sometimes long durations, e.g.: duration="549648" ms ≈ 9 minutes This roughly matches the 8-minute delay observed. phantom_forward_modalert.log and phantom_retry.log confirm the app version is 4.3.26 and the KV Store has no pending items. The delay seems to come from long processing time inside the modular action within Splunk, not from connectivity or network issues.

kn450 · ‎12-07-2025

I am using sendtophantom in Splunk ES to send events to SOAR. The action shows success in the logs, but the events reach SOAR with a delay of about 8 minutes.

kn450 · ‎11-07-2025

Thanks in advance for the help. I’ve created an eventtype="auth_successful" for VPN logs and I’d like to create field extractions based on this eventtype. I tried using a stanza like this in props.conf: [eventtype=auth_successful] EXTRACT-fields = ... but it didn’t work. It seems Splunk doesn’t support applying props directly to eventtypes (like it does for sourcetype, source, or host). Can someone confirm if this is the case, and what’s the best way to scope extractions so they only apply to events matching this eventtype? Thanks!

kn450 · ‎11-05-2025

Hi @prewin, Thanks for the detailed explanation. For the first method — I’m using Splunk Connect for Syslog (SC4S), so I’m not exactly sure where I can modify or split the sources there as in the syslog-ng example. As for the second method (using props.conf and transforms.conf), I tried it but it didn’t work for me. I believe the reason is that my data is already indexed, and as far as I understand, these configurations are only applied at index time, typically on the forwarder or heavy forwarder before the data reaches the indexer.

kn450 · ‎11-04-2025

Hi everyone, I’m currently working on creating field extractions using the Field Extractor in Splunk. However, I’ve run into an issue when the sourcetype is nix:syslog. Here’s the situation: I’m sending logs from multiple products through syslog, and they all share the same sourcetype = nix:syslog. When I use the Field Extractor to create an extraction for one product, it automatically applies to all sources that use this sourcetype. This causes incorrect extractions for the other products since their log formats are different. What I’d like to do is create field extractions based on eventtype (or possibly source or host) instead of sourcetype. Ideally, I’d like to define extractions per eventtype, since that would give me much better control and separation between products. Is there a way to do this in Splunk — to have field extractions scoped or applied by eventtype (or source/host) instead of sourcetype? Any advice or best practices would be greatly appreciated. Thanks in advance!

kn450 · ‎10-29-2025

I hope you’re all doing well. I am currently working on a project involving exporting large volumes of data from Splunk to Elasticsearch / OpenSearch, and I would like to tap into your expertise and assistance on this matter. Project background: We’re using Splunk as our repository and analytical tool for security and operational data. Due to the license size constraints in Splunk, there’s a need to export this data to Elasticsearch, where scalability and storage capabilities are better. The goal is to export the data with the exact same field names as used in Splunk without changing or losing any field names so that we can continue our queries and analysis using the same structure we have in Splunk. If you like, I can send you a shorter version or a version tailored for a specific forum or audience.

kn450 · ‎10-07-2025

Hello Splunk community! I’m planning a project that involves sending event data from Splunk to Elasticsearch using Kafka, and I haven’t started implementing it yet. I’m looking for your guidance nd assistance to implement this solution efficiently and securely. I would greatly appreciate any advice, recommendations, or ready-to-use tools to help with: Extracting data from a Splunk index. Sending the data to Kafka as a temporary transport layer. Formatting events in JSON with a consistent schema. Ingesting data into Elasticsearch with proper index settings. Any experience, suggestions, or guidance from the community would be highly appreciated

kn450 · ‎08-28-2025

Hi Prewin, I restarted the Kafka server as suggested, but the issue persists. The Kafka broker is not receiving any events on the topics. Here is the error message I see in the dashboard: Kafka topics are not receiving events. Monitor for an hour, if the status does not go back to OK, restart kafka-server. If this does not help, contact Splunk Support. Status code KAFKA-1 I’ve checked the following, but the problem remains: The Kafka topics exist and the names are correct. Network connectivity to the Kafka broker on port 9092 is fine. Splunk (the producer) is configured to send events, but no data appears in the topics. There are no relevant errors in the Kafka logs, so it’s unclear why events are not arriving. Could you please advise on why this keeps happening and how we can resolve it? Thanks,

kn450 · ‎08-27-2025

Hello, I’m experiencing an issue with my Kafka broker integration with Splunk. The error message I’m seeing is: Kafka Broker Error Topic bytes in The rate, expressed in bytes per second, of the message traffic each topic is receiving from producing clients Error: Kafka topics are not receiving events. Monitor for an hour, if the status does not go back to OK, restart kafka-server. If this does not help, contact Splunk Support. Status code KAFKA-1 I have monitored for more than an hour, and the status did not return to OK. Has anyone faced this issue before or have suggestions on how to fix it? Thanks in advance!

kn450 · ‎08-25-2025

Hello Splunk Community, I am a new Splunk UBA user and I am currently trying to pull data from Splunk Enterprise into Splunk UBA using time-based searches. I have followed the official UBA documentation and configuration guides, but I am still struggling to fully understand the process due to my limited experience with UBA. Specifically, I am trying to: Configure UBA to pull notable events and risk events from Splunk Enterprise Security. Use time-based searches to collect data efficiently without missing events. Understand how SPL queries and External Alarm categories work in this integration. I would greatly appreciate any guidance, examples, or best practices you can share to help me successfully implement this integration. Additionally, if you could suggest external resources, tutorials, or blogs that explain the process in a beginner-friendly way, that would be extremely helpful. Thank you in advance for your support

kn450 · ‎08-09-2025

If after applying the steps to secure Splunk Web using certificates (SSL/TLS), it gets stuck at: ``` Waiting for web server at https://127.0.0.1:8000 to be available............................... ``` but when you disable the certificates, it works normally,

kn450 · ‎08-09-2025

How enaple TLS in splunk platform from ca

kn450 · ‎08-09-2025

Hello everyone, I’m encountering an issue when trying to enable secure HTTPS access on Splunk Web using an SSL certificate issued by a trusted external CA. What I did: Placed the SSL certificate file (splunkWeb.pem) in the following path: $SPLUNK_HOME/etc/apps/webTLS/certs/splunkWeb.pem Edited the web.conf file with the following settings: ini CopyEdit [settings] enableSplunkWebSSL = true serverCert = $SPLUNK_HOME/etc/apps/webTLS/certs/splunkWeb.pem privKeyPath = $SPLUNK_HOME/etc/apps/webTLS/certs/splunkWeb.pem Restarted the Splunk service. Issue: After restarting, Splunk hangs during startup and the web interface does not become available over HTTPS. Questions: Are there additional steps required when using an external SSL certificate? Is the web.conf configuration correct, especially regarding the privKeyPath pointing to the same .pem file as serverCert? Should the private key be in a separate file from the certificate? Any advice or similar experiences would be greatly appreciated. Thank you in advance for your help!

kn450 · ‎06-25-2025

Hello everyone, I have a network monitoring system that exports data via IPFIX using Forwarding Targets. I am trying to receive this data in Splunk using the Splunk Stream app. The add-on is installed and Stream is enabled, but I am facing the following issues: Templates are not being received properly. The data arrives, but it's unreadable or incomplete. I need full flow data, including summaries or headers from Layer 7 (e.g., HTTP, DNS). My question: Has anyone successfully received and parsed IPFIX data in Splunk? If so, could you share the steps or configurations you used (like streamfwd.conf, input settings, etc.)? Any guidance would be greatly appreciated! Thanks in advance!

kn450 · ‎06-20-2025

I changed the time and the pack size, but the problem still exists.

kn450 · ‎06-20-2025

Hi Splunk Community, I'm currently integrating Flowmon ndr as a NetFlow data exporter to Splunk Stream, but I’m encountering a persistent issue where Splunk receives the flow data, yet it’s not decoded properly, and flow sets are being dropped due to missing templates. Here’s the warning from the Splunk log: ``` 2025-06-21 08:34:49 WARN [139703701448448] (NetflowManager/NetflowDecoder.cpp:1282) stream.NetflowReceiver - NetFlowDecoder::decodeFlow Unable to decode flow set data. No template with id 258 received for observation domain id 13000 from device 10.x.x.x. Dropping flow data set of size 328 ``` Setup details: Exporter: Flowmon Collector: Splunk Stream Protocol: NetFlow v9 (also tested with IPFIX) Transport: UDP Template Resend Configuration: Every 4096 packets or 600 seconds Despite verifying these settings on Flowmon, Splunk continues to report that the template ID (in this case, 258) was never received, causing all related flows to be dropped. My questions: 1. Has anyone successfully integrated Flowmon with Splunk Stream using NetFlow v9? 2. Is there a known issue with Splunk Stream not handling templates properly from certain exporters? 3. Are there any recommended Splunk Stream configuration tweaks for handling late or infrequent templates? Any insights, experiences, or troubleshooting tips would be greatly appreciated. Thanks in advance!

kn450 · ‎06-02-2025

opt/caspida/bin/Caspida setuphadoop ...............................Failed to run sudo -u hdfs hdfs namenode -format >> /var/vcap/sys/log/caspida/caspida.out 2>&1 Fri Jun 2 17:06:11 +07 2023: [ERROR] Failed to run hadoop_setup [2]. Fix errors and re-run again. Error in running /opt/caspida/bin/Caspida setuphadoop on 192.168.126.16. Fix errors and re-run again. i execute the command /opt/caspida/bin/caspida setup but stopped here hadoopsetup can't run, i don't know the cause yet. someone please help me. I put some install logs here

kn450 · ‎05-20-2025

We have indeed used the mentioned add-on and were able to successfully retrieve data from Elasticsearch. However, it's important to note that the queries used are not written in Splunk’s native SPL language; instead, they rely on Elasticsearch queries. This limits the integration with some of Splunk’s core functionalities and does not provide the desired level of efficiency in terms of performance and deep analysis. We are currently looking for best practices and would prefer to adopt a solution that has been widely used over a long period without issues, offering better integration and higher performance with Splunk. If you have any proven experiences or reliable recommendations, we would appreciate you sharing them

kn450 · ‎05-20-2025

Thank you for your input. We have indeed used the mentioned add-on and were able to successfully retrieve data from Elasticsearch. However, it's important to note that the queries used are not written in Splunk’s native SPL language; instead, they rely on Elasticsearch queries. This limits the integration with some of Splunk’s core functionalities and does not provide the desired level of efficiency in terms of performance and deep analysis. We are currently looking for best practices and would prefer to adopt a solution that has been widely used over a long period without issues, offering better integration and higher performance with Splunk. If you have any proven experiences or reliable recommendations, we would appreciate you sharing them.

Posts	32
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-05-2025

Online Status	Online
Date Last Visited	a minute ago

Global config JSON file not found!` error in `send...

Struggling with setting up SC4S in an air-gapped e...

Delay Sending Threats from Splunk ES to Splunk SOA...

Delay in Sending Threats to SOAR

splunk to soar

using the Field Extractor in sourcetype is nix:sys...

Requesting Help: Sending Event Data from Splunk to...

Kafka Broker Error – Topics not receiving events (...

Assistance Needed: Pulling Data from Splunk Enterp...

enaple TLS in splunk platform

Global config JSON file not found!` error in `send...

Struggling with setting up SC4S in an air-gapped e...

Delay Sending Threats from Splunk ES to Splunk SOA...

Delay in Sending Threats to SOAR

Re: splunk to soar

Re: splunk to soar

Re: splunk to soar

splunk to soar

Re: using the Field Extractor in sourcetype is nix...

Re: using the Field Extractor in sourcetype is nix...

using the Field Extractor in sourcetype is nix:sys...

Re: Requesting Help: Sending Event Data from Splun...

Requesting Help: Sending Event Data from Splunk to...

Re: Kafka Broker Error – Topics not receiving even...

Kafka Broker Error – Topics not receiving events (...

Assistance Needed: Pulling Data from Splunk Enterp...

Re: enaple TLS in splunk platform

enaple TLS in splunk platform

Issue enabling HTTPS on Splunk Web using external ...

Need help receiving and parsing IPFIX data in Splu...

Re: Issue with NetFlow v9 Templates Not Received b...

Issue with NetFlow v9 Templates Not Received by Sp...

install splunk uba

Re: Accessing Elasticsearch Data from Splunk Using...

Re: Accessing Elasticsearch Data from Splunk Using...

Join the Conversation