There are a couple of ways to look at this. Do you have access to the OS and if so, which OS (linux or Windows) In linux you could change to the splunk install dir (usually /opt/splunk), change to etc and run find . -name savedsearches.conf -exec grep -H -E "\[|splunkdata@gmail.com" {} \; This should give the list of files and search names that have the email address configured for it. Depending on how many alerts, you could look into using sed to modify each value. You would need to restart Splunk afterwards. I am not so familiar with Windows but I am sure a similar "find" function could be done in powershell. ... View more

For this I would normally use something that profiles the endpoint, but does looking at the difference between the login event and maybe the time when explorer.exe starts   ... View more

Breaking an episode should have little impact on or by Bidirectional Ticketing.  If the NEAP is creating the ticket, then the new episode will create a new ticket, this will also be linked to the new episode as per what I think is your existing flow. ... View more

For the default configuration, ie no verification, then no certificate needs to be configured on the client end. If you are looking to enable either client authentication (client must send a valid cert but its not checked beyond valid) or client verification (client provided certificate must match either CN or SAN) then you must define the client cert settings. On the server side (in this case the indexer) the setttings in inputs.conf are requireClientCert = <boolean>  Client must provide a valid certificate, but its not checked sslCommonNameToCheck = <comma-separated list> sslAltNameToCheck = <comma-separated list> Either of the above fill force the server end to actually fully validate the certificate against the identity of the host.  e.g. if sslAltNameToCheck is set to splunkforwarder, then the certificate presented by the client must have the SAN field in the certificate set to include "splunkforwarder" otherwise the client is deemed to have failed authentication. When getting to this level of verification, there are a few certificates that need to be distributed and configured to ensure that the Splunk instance is able to complete the verification all the way back to a trusted root CA.   ... View more

The simplest analogy I can think of, is to simply consider this the same as the connection to a HTTPS web server. Client - end initiating the connection Server - Target of the connection. For a basic SSL connection, only the server-side certificate is of any consequence. The client certificate needs to be defined, but it is not used. The client (sender) certificate only become relevant when you configure client verification on the server-side. So, in this case you should be fine to use the same certificate on both ends of the SSL connection.   ... View more

No problems. Essentially, until you are really comfortable with it, I always try and stick to the following for customers. 1. Unless you need to use organisational certificates, simply use the ones that Splunk generates.       You can easily regenerate these using a splunk command       bin/splunk createssl 2. Start simple and work your way up - the further down this list, the more error prone and harder to troubleshoot      a) default certs      b) org certs      c) server verification (client verifies the server cert)      d) client verification  (server verifies the client cert) 3. Get familar with tools/commands like "openssl s_client" that can be used to verify the certificate exchange, etc.     This can be really helpful to understand where the ssl protocol may be failing      e.g. openssl s_client -connect indexer:9997 -debug -showcerts  ... View more

If it is being done to meet an org requirement, then it looks like the whole certificate process may need to be re-visited ... View more

Hmm. Looks like there is something wrong with the cert. Are you creating your own cert due to organisation requirements or for some other reason. If you are crating "just because" then I might suggest just using the certs and config from earlier that worked. If it is being done to meet an org requirement, then it looks like the whol ... View more

If you search index=_internal x509 since the last restart of the indexer, does anything show up   ... View more

This indicates that the issue is likely to be certificate or file permissions related. As a side note, not sure why you have the server cert on the client end. Can you please confirm the certificate you are trying to configure on the server side (inputs.conf) includes all the certificates in the chain that would be required to fully verify (host all the way back to root ca). ... View more

This should work, as a test, place each part on the required element outputs.conf --------- [tcpout] defaultGroup = indexers indexAndForward = false [tcpout:indexers] server = x:9997 useSSL = true sslCertPath = $SPLUNK_HOME/etc/auth/server.pem sslPassword = password inputs.conf ----- [splunktcp-ssl:9997] disabled = 0 [SSL] serverCert = $SPLUNK_HOME/etc/auth/server.pem sslPassword = password requireClientCert = false ... View more

Change both ends just to be sure. ... View more

Are you able to revert all elements to use the default certificate /etc/auth/server.pem You can also check the internal logs (index=_internal) and look for x509 This will normally on appear after a reboot.   ... View more

Thanks for that.  In the inputs.conf on the indexer, can you please confirm that the SSL stanza is wrapper correctly. Your config has the incorrect closing bracket. [SSL} rather than [SSL] Everything else looks good. Another possible step is to revert to using the default certs created by Splunk when installing/running.  This would eliminate any certificate issues such as access, wrong permissions, wrong order of certs, etc. ... View more

The SSL settings in server.conf are to control the server used by splunkd and not what gets used in either the web ui or for tcp connections. It is entirely possible to different certificates for different parts of the Splunk solution. ... View more

Hi there.  I strongly recommend that, at least to start with, do not do any client or server verification until the basic SSL connections are working. Before heading down the rabbit hole of SSL, can I please confirm the following 1. outputs.conf on the sender (client)      useSSL = true      sslCertPath = path to client certificate (can be the self signed one)      sslPassword 2. inputs.conf on the receiver (server)      the input def should be splunktcp-ssl not splunktcp      [SSL] stanza should be defined with the following      serverCert = path to combined cert      sslPassword      requireClientCert = false ... View more

Hi, here is a working skeleton that shows the concept. <form version="1.1"> <label>Sample Dropdown Selector</label> <fieldset submitButton="false"> <input type="dropdown" token="select"> <label>select</label> <choice value="All">All</choice> <choice value="Table">Table</choice> <choice value="Single">Single</choice> <choice value="Graph">Graph</choice> <choice value="None">None</choice> <default>None</default> <initialValue>None</initialValue> <change> <condition value="All"> <set token="Table"></set> <set token="Graph"></set> <set token="Single"></set> </condition> <condition value="Table"> <unset token="Single"></unset> <unset token="Graph"></unset> <set token="Table"></set> </condition> <condition value="Graph"> <unset token="Table"></unset> <unset token="Single"></unset> <set token="Graph"></set> </condition> <condition value="Single"> <unset token="Table"></unset> <set token="Single"></set> <unset token="Graph"></unset> </condition> <condition value="None"> <unset token="Table"></unset> <unset token="Single"></unset> <unset token="Graph"></unset> </condition> </change> </input> </fieldset> <row> <panel depends="$Table$"> <title>Table</title> <table> <search> <query>| makeresults count=10 | streamstats count | eval title="Item "+count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$Single$"> <title>Single</title> <single> <search> <query>| makeresults count=10 | streamstats count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </single> </panel> <panel depends="$Graph$"> <title>Graph</title> <chart> <search> <query>| makeresults count=10 | streamstats count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> </form>   ... View more

Hi there.  It looks like you dropdown logic is correct. Set a token to display the panel, unset token to hide the panel. To display all, simply set all tokens. For each panel you want to hide/show, ensure you have something similar to the following You would have a token for each of the elements you want to conditionally display; table, single, and graph. <panel depends="$graph$"> </panel> <panel depends=$table$"> </panel> <panel depends=$single$"> </panel>   with the required elements in them ... View more

The lookup itsi_notable_event_external_ticket is updated when ITSI creates the external ticket. If you search the audit records `itsi_notable_audit_index` sourcetype=itsi_notable:audit you will should, if the NEAP is creating the ticket, see events with fields like    action_name: snow_incident    activity: Action="snow_incident" executed.    activity_type: Action Executed for Episode. One of the fields is the search_command. Towards the end of the string you should see something like sendalert "itsi_event_action_snow_wrapper" (I am using ServiceNow) It is this alert wrapper that raises the ticket with SNOW, and updates the kvstore lookup with the returned values. ... View more

Hi It is hard to tell if this should be a single event, or if it is multiple events. Assuming this is multiple events broken on a \n followed by date, the following should work props.conf [ mysourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=(\n)\d{4} NO_BINARY_CHECK=true TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N ... View more

Please pay attention to the "order of operations" posted earlier. Fields from a previous step are available in subsequent steps except for calculated fields (they run in parallel), so, If you configure either an inline field extraction, or an additional Transforms that is executed first, then you would be able to use the field. E.g props.conf [sourcetype] EXTRACT-list = regex_to_extract_the_list REPORT-ip = ip_from_list transforms.conf [ip_from_list] MV_ADD = 1 SOURCE_KEY = list REGEX = c=IN\sIP4\s(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}) FORMAT = IP::$1 ... View more

Hi The most likely suspect is the field "list" does not exist when the transform attempts to execute. Search time order of operations are Inline extraction from props Transform-based extraction Auto KV fields Field-Alias Calc fields Lookups Eventtypes Tags Can you please provide some insight into how/when the field "list" used as the SOURCE_KEY is extracted. Thanks. ... View more

Hi, Are you able to provide a sample of the data you are attempting to extract from. ... View more