Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About eric_budke
eric_budke
Path Finder
Member since:
04-02-2013
03-27-2025
Community Statistics
| Posts | 14 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 10 |
| Member Since | 04-02-2013 |
Activity Feed
- Posted Re: Cannot find the "Webhook allow list" settings in Splunk Cloud Trial Version on Splunk Cloud Platform. 03-27-2025 08:43 AM
- Karma Re: how to check traffic volume per heavy forawrder for thambisetty. 03-14-2025 11:17 AM
- Karma Splunk Support for Active Directory: After upgrading to Splunk 6.5.1, why does scheduled search stop after 900 seconds? for brettwilliams. 06-05-2020 12:48 AM
- Karma Re: How can I limit the results of a stats values() function? for thisissplunk. 06-05-2020 12:48 AM
- Got Karma for Re: What happened to the bulk FP and Reviewed buttons on the triage page.. 06-05-2020 12:48 AM
- Got Karma for Re: Enterprise Security - New Domain Analysis Dashbaord - Help with the WHOIS functionality. 06-05-2020 12:47 AM
- Karma Re: indexes from peer nodes not visible in role creation on search head for rbal_splunk. 06-05-2020 12:46 AM
- Karma Re: indexes from peer nodes not visible in role creation on search head for arowsell_splunk. 06-05-2020 12:46 AM
- Got Karma for Re: OPSEC LEA with CheckPoint: SIC ERROR 119 - SIC Error for ssl_opsec: Client could not choose an authentication method for service ssl_opsec. 06-05-2020 12:46 AM
- Got Karma for Re: OPSEC LEA with CheckPoint: SIC ERROR 119 - SIC Error for ssl_opsec: Client could not choose an authentication method for service ssl_opsec. 06-05-2020 12:46 AM
- Got Karma for Re: OPSEC LEA with CheckPoint: SIC ERROR 119 - SIC Error for ssl_opsec: Client could not choose an authentication method for service ssl_opsec. 06-05-2020 12:46 AM
- Got Karma for Re: OPSEC LEA with CheckPoint: SIC ERROR 119 - SIC Error for ssl_opsec: Client could not choose an authentication method for service ssl_opsec. 06-05-2020 12:46 AM
- Got Karma for Re: OPSEC LEA with CheckPoint: SIC ERROR 119 - SIC Error for ssl_opsec: Client could not choose an authentication method for service ssl_opsec. 06-05-2020 12:46 AM
- Got Karma for Re: Cisco Secure ACS 5.x. 06-05-2020 12:46 AM
- Got Karma for Re: Cisco Secure ACS 5.x. 06-05-2020 12:46 AM
- Got Karma for Re: Cisco Secure ACS 5.x. 06-05-2020 12:46 AM
- Posted Trying to get the tokens to work in other fields on All Apps and Add-ons. 11-07-2018 05:30 AM
- Tagged Trying to get the tokens to work in other fields on All Apps and Add-ons. 11-07-2018 05:30 AM
- Tagged Trying to get the tokens to work in other fields on All Apps and Add-ons. 11-07-2018 05:30 AM
- Posted Re: What happened to the bulk FP and Reviewed buttons on the triage page. on All Apps and Add-ons. 06-30-2017 05:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-27-2025
08:43 AM
This is likely due to permissions. The sc_admin role has the permissions. I can probably be handed out more granularly too.
... View more
11-07-2018
05:30 AM
Need to use a calculated (date) value within the request payload. My python is weak and attempts to alter it so far haven't worked. I have the relevant token properly done but the replaceTokens on the payload_request field doesn't seem to be taking.
... View more
06-30-2017
05:36 AM
1 Karma
Crap, may be at the bottom, but less bold. Now how to delete a question, RME.
... View more
06-30-2017
05:34 AM
These buttons were there in 1.6. It is now pretty painful to go through each entry to clear them out.
... View more
12-30-2016
10:55 AM
That worked well.
... View more
12-20-2016
12:35 PM
On the app home page: whois and domain profile everything I'm licensed for works now.
On the DTSearch page the errors don't show. Now searches on google or my own turn up nothing, including a lack of errors on the screen.
... View more
12-13-2016
12:53 PM
Probably the same source error for all based on eyeballing it but
Whois info
Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-domaintools/bin/domaintools-cmd.py", line 168, in **kwargs) File "/opt/splunk/etc/apps/TA-domaintools/bin/domaintools-cmd.py", line 63, in generating_main extracted
= tldextract.extract(domain_or_ip) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 303, in extract return TLD_EXTRACTOR(url) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 183, in __call__ suffix_index = self._get_tld_extractor().suffix_index(translations) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 230, in _get_tld_extractor tlds = self._get_snapshot_tld_extractor() File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 268, in
_get_snapshot_tld_extractor snapshot_stream = pkg_resources.resource_stream(__name__, '.tld_set_snapshot') File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 892, in resource_stream self, resource_name File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 1289, in get_resource_stream return open(self._fn(self.module_path, resource_name), 'rb') IOError: [Errno 2] No such file or directory: '/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/.tld_set_snapshot'
Registrar Info
Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-domaintools/bin/domaintools-cmd.py", line 168, in **kwargs) File "/opt/splunk/etc/apps/TA-domaintools/bin/domaintools-cmd.py", line 63, in generating_main extracted = tldextract.extract(domain_or_ip) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 303, in extract return TLD_EXTRACTOR(url) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 183, in __call__ suffix_index = self._get_tld_extractor().suffix_index(translations) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 230, in _get_tld_extractor tlds = self._get_snapshot_tld_extractor() File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 268, in _get_snapshot_tld_extractor snapshot_stream = pkg_resources.resource_stream(__name__, '.tld_set_snapshot') File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 892, in resource_stream self, resource_name File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 1289, in get_resource_stream return open(self._fn(self.module_path, resource_name), 'rb') IOError: [Errno 2] No such file or directory: '/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/.tld_set_snapshot'
Reg Info
Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-domaintools/bin/domaintools-cmd.py", line 168, in **kwargs) File "/opt/splunk/etc/apps/TA-domaintools/bin/domaintools-cmd.py", line 63, in generating_main extracted = tldextract.extract(domain_or_ip) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 303, in extract return TLD_EXTRACTOR(url) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 183, in __call__ suffix_index = self._get_tld_extractor().suffix_index(translations) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 230, in _get_tld_extractor tlds = self._get_snapshot_tld_extractor() File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 268, in _get_snapshot_tld_extractor snapshot_stream = pkg_resources.resource_stream(__name__, '.tld_set_snapshot') File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 892, in resource_stream self, resource_name File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 1289, in get_resource_stream return open(self._fn(self.module_path, resource_name), 'rb') IOError: [Errno 2] No such file or directory: '/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/.tld_set_snapshot'
All the rest of the fields in the whois/domain profile page give this too.
The New domains dashboard seems to be working because ES is populating the whois index.
The DomainTools Search page gives on a whois search or whois parsed on google.com
Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-domaintools/bin/domaintools-cmd.py", line 168, in **kwargs) File "/opt/splunk/etc/apps/TA-domaintools/bin/domaintools-cmd.py", line 63, in generating_main extracted = tldextract.extract(domain_or_ip) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 303, in extract return TLD_EXTRACTOR(url) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 183, in __call__ suffix_index = self._get_tld_extractor().suffix_index(translations) File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 230, in _get_tld_extractor tlds = self._get_snapshot_tld_extractor() File "/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/tldextract.py", line 268, in _get_snapshot_tld_extractor snapshot_stream = pkg_resources.resource_stream(__name__, '.tld_set_snapshot') File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 892, in resource_stream self, resource_name File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 1289, in get_resource_stream return open(self._fn(self.module_path, resource_name), 'rb') IOError: [Errno 2] No such file or directory: '/opt/splunk/etc/apps/TA-domaintools/bin/tldextract/.tld_set_snapshot'
... View more
12-13-2016
12:09 PM
Was ignoring the lowercase https_proxy. Adding in the uppercase HTTPS_PROXY it does go out for the domain profile but errors out on everything else (reputation score we don't have access to yet, but JSON errors on the rest). Again, no proxy, no issues.
Splunk docs imply that HTTPS_PROXY only needed to be added if proxy requires HTTPS.
... View more
12-09-2016
10:25 AM
Hi Mark (developer of the add-on)
https://splunkbase.splunk.com/app/3376/
I also sent this in via email directly, but it may help others here. The DomainTools TA for Splunk reaches out directly, not abiding by the splunk-launch.conf configuration to use a proxy. As such in my case, it never reaches api.domaintools.com. I verified my keys etc on an external Splunk instance. TCPdump also agrees with the assessment.
... View more
01-14-2015
01:10 PM
1 Karma
Search for "whois" at http://docs.splunk.com/Documentation/ES/3.2/Install/AdvancedThreatdashboards
You need to sign up for another service at domaintools at a minimum it looks like.
... View more
12-31-2014
02:09 PM
Trying the latest (2.0.1) on 6.2.1. Takes incredibly long compared to an old version and it isn't parsing itself well.
i.e. Returned fields on
|ldapsearch domain=nb.com search="(&(objectclass=user)(!(objectClass=computer)))"
|search sAMAccountName=someusername
|table *
accountExpires cn codePage countryCode dSCorePropagationData description displayName distinguishedName extensionAttribute15 givenName host instanceType lastLogonTimestamp name objectCategory objectClass objectGUID objectSid primaryGroupID pwdLastSet sAMAccountName sAMAccountType uSNChanged uSNCreated userAccountControl userPrincipalName whenChanged whenCreated _raw _time
vs Old version, same query on same machine....and I removed a whole bunch. Also returns in ~1minute compared to 15+ for the newer version.
accountExpires adminCount altRecipient altRecipientBL assistant authOrig authOrigBL badPasswordTime badPwdCount businessCategory c cn co codePage company countryCode dSCorePropagationData deletedItemFlags delivContLength deliverAndRedirect department description directReports displayName displayNamePrintable distinguishedName dn employeeID extensionAttribute1 extensionAttribute10 extensionAttribute11 extensionAttribute12 extensionAttribute13 extensionAttribute14 extensionAttribute15 extensionAttribute2 extensionAttribute3 extensionAttribute4 extensionAttribute5 extensionAttribute6 extensionAttribute7 extensionAttribute9 facsimileTelephoneNumber garbageCollPeriod givenName homeDirectory homeDrive homeMDB homeMTA homePhone host info initials instanceType internetEncoding lastKnownParent lastLogoff lastLogon lastLogonTimestamp legacyExchangeDN lockoutTime logonCount logonHours mail mailNickname managedObjects manager memberOf mobile msNPAllowDialin msRTCSIP-DeploymentLocator msRTCSIP-FederationEnabled msRTCSIP-InternetAccessEnabled msRTCSIP-Line msRTCSIP-LineServer msRTCSIP-OptionFlags msRTCSIP-OriginatorSid msRTCSIP-PrimaryHomeServer msRTCSIP-PrimaryUserAddress msRTCSIP-UserEnabled msRTCSIP-UserPolicies msRTCSIP-UserPolicy msTSExpireDate msTSLicenseVersion msTSManagingLS name objectCategory objectClass objectGUID objectSid otherMobile otherTelephone pager personalTitle physicalDeliveryOfficeName pwdLastSet sAMAccountName sAMAccountType scriptPath securityProtocol servicePrincipalName showInAddressBook showInAdvancedViewOnly sn source sourcetype st streetAddress submissionContLength telephoneNumber thumbnailPhoto title uSNChanged uSNCreated userAccountControl userCertificate userParameters userPassword userPrincipalName userWorkstations wWWHomePage whenChanged whenCreated _raw _time
... View more
05-08-2014
01:13 PM
3 Karma
You can send it via syslog. It is a little time consuming initially, but go to System Administration->Log Configuration->Logging Categories->Global and edit all of them and add the syslog destination in.
You have to set up a remote log target first in System Administration->Log Configuration->Remote Log Targets
... View more
11-22-2013
11:45 AM
5 Karma
Would like to thank Splunk Support for this. But we weren't using ssl_opsec but sslca. The problem was that our CP admin hadn't given the proper Entity SIC name. I'd used the same as the SIC name since that was the only one our CP guy was aware of. The Entity SIC Name needed to be changed to CN=cp_mgmt,O=yourcphost.domain.com.oschxt
(where O=yourcohost.domain.com.oschxt was the same as in the plain SIC name.)
There's no way of pulling this info from the CP gui I'm told.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-27-2025
02:03 PM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
