Hi guys, I have an issue with the Enterprise Security APP where I try to add a new Event Attributes (user) that is correctly populated and available in the event (in the Contributing Events search)  and in the datamodel, but it is not showed in the Incident Review table. It seems that It can be an error with the alias of the field because in the data raw we see that the field name is " userPrincipalName" but in the Interesting Field we have "user" (the field that is now showed in the Incident Review table). We also tried adding the userPrincipalName field to the Event Attributes but also this field is not populated. How can we show that field in the table? Thanks, Mauro    ... View more

Hi all, I would like to know if it is possible to deploy a single new app from the Deployer to a Search Head without losing all the apps already installed in the Search Head. Now the shcluster / apps directory is empty and I would like to know if I can just insert the new app and push it with the command "splunk apply shcluster-bundle" with some special arguments that allow me not to delete all the other apps. Thanks, Mauro  ... View more

Hi! I tried removing an app from a Search Head cluster, deleting it from the deployer's shcluster/apps directory and pushing the other apps, but this doesn't work properly and the app stays on my Search Heads. Is there another way to remove it? Thanks, Mauro ... View more

I tried to install the Enterprise Security on my own computers, but after the first restart of Splunk Enterprise, the second restart (after the ES initial configuration) didn't complete.  I have a PC with 32Gb RAM and 4CPU Is it a problem? Is it possible to install the ES in an all-in-one configuration? Thanks, Mauro   ... View more

Hi, I'm trying to get the Splunk user that making changes in kv store. I tried to use the rest call but the User_Name fields return " undefined". I launch this search from javascript. | inputlookup open_cases | eval Notes=if(_key=\"" + key + "\",\"" + mod_notes + "\",Notes), Status=\"Work-in-progress\" | appendcols [ | rest /services/authentication/current-context | rename username AS User_Name | fields User_Name] | search _key=\"" + key + "\" | outputlookup open_cases append=true | eval key=_key Can you help me to get the right username value? Thanks, Mauro   ... View more

Hi, I have a button that take values from splunk's tokens, launch a search that update a KV Store and refresh the page. Is there a method to unset the splunk's token after the page refresh? I tried with the "tokens.unset("name of the token", null);" command in javascript but this method didn't work for me. I took all the tokens with this command "var tokens = mvc.Components.get("default");" Thanks, Mauro ... View more

Hi, I'm trying to use the "Palo Alto Networks Add-on for Splunk", but when I try to configure it, the page always remains loading. I opened the splunkd.log and found this error: 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': SyntaxError: invalid syntax 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': Traceback (most recent call last): 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': File "D:\Splunk\bin\runScript.py", line 82, in 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': exec(open(REAL_SCRIPT_NAME).read()) 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': File "", line 4, in 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': File "D:\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\splunktaucclib\rest_handler\endpoint\validator.py", line 388 11-25-2019 14:53:52.330 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': except ValueError, exc: 11-25-2019 14:53:52.331 +0100 ERROR ScriptRunner - stderr from 'D:\Splunk\bin\Python3.exe D:\Splunk\bin\runScript.py setup': ^ Can anyone help me? Thanks, Mauro ... View more