Hi, we have several Universal Forwarders managed by a Deployment Server that occasionally "lose" applications and stop sending logs to Indexers and are no longer connected to the Deployment Server. The only way to reconnect these UFs is to reinstall the connection apps to the DS manually by logging into the host, and then manage it again from the DS. How does this happen? Is there any other way to reconnect these UFs to the DS without necessarily logging in? Thanks, Mauro   ... View more

Hello!  One of our customer has a problem with this executable "C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" that tries to launch this command "C:\Program Files\SplunkUniversalForwarder_script\files\blat\blat.exe" -install mailrelay2.domain.com hostname@domain.com  Can you help me to understand if this process is generated from Splunk or if it is a custom process? Thank you, Mauro ... View more

Hi guys, I have an issue with the Enterprise Security APP where I try to add a new Event Attributes (user) that is correctly populated and available in the event (in the Contributing Events search) and in the datamodel, but it is not showed in the Incident Review table. It seems that It can be an error with the alias of the field because in the data raw we see that the field name is "userPrincipalName" but in the Interesting Field we have "user" (the field that is now showed in the Incident Review table). We also tried adding the userPrincipalName field to the Event Attributes but also this field is not populated. How can we show that field in the table? Thanks, Mauro    ... View more

Hi all, I would like to know if it is possible to deploy a single new app from the Deployer to a Search Head without losing all the apps already installed in the Search Head. Now the shcluster / apps directory is empty and I would like to know if I can just insert the new app and push it with the command "splunk apply shcluster-bundle" with some special arguments that allow me not to delete all the other apps. Thanks, Mauro  ... View more

Hi! I tried removing an app from a Search Head cluster, deleting it from the deployer's shcluster/apps directory and pushing the other apps, but this doesn't work properly and the app stays on my Search Heads. Is there another way to remove it? Thanks, Mauro ... View more

I tried to install the Enterprise Security on my own computers, but after the first restart of Splunk Enterprise, the second restart (after the ES initial configuration) didn't complete.  I have a PC with 32Gb RAM and 4CPU Is it a problem? Is it possible to install the ES in an all-in-one configuration? Thanks, Mauro   ... View more

Hi, I'm trying to get the Splunk user that making changes in kv store. I tried to use the rest call but the User_Name fields return "undefined". I launch this search from javascript. | inputlookup open_cases | eval Notes=if(_key=\"" + key + "\",\"" + mod_notes + "\",Notes), Status=\"Work-in-progress\" | appendcols [ | rest /services/authentication/current-context | rename username AS User_Name | fields User_Name] | search _key=\"" + key + "\" | outputlookup open_cases append=true | eval key=_key Can you help me to get the right username value? Thanks, Mauro   ... View more

Hi, I have a button that take values from splunk's tokens, launch a search that update a KV Store and refresh the page. Is there a method to unset the splunk's token after the page refresh? I tried with the "tokens.unset("name of the token", null);" command in javascript but this method didn't work for me. I took all the tokens with this command "var tokens = mvc.Components.get("default");" Thanks, Mauro ... View more

Hi, I'm trying to use the "Palo Alto Networks Add-on for Splunk", but when I try to configure it, the page always remains loading. I opened the splunkd.log and found this error: 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': SyntaxError: invalid syntax 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': Traceback (most recent call last): 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': File "D:\Splunk\bin\runScript.py", line 82, in 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': exec(open(REAL_SCRIPT_NAME).read()) 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': File "", line 4, in 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': File "D:\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\splunktaucclib\rest_handler\endpoint\validator.py", line 388 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': except ValueError, exc: 11-25-2019 14:53:52.331 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': ^ Can anyone help me? Thanks, Mauro ... View more