Had the same issue, here is what fixed it for me: Downgraded my Splunk HF from 9.0.1 to the same version with the UFs that send data to it. There seems to be a conflict with the version mismatch, even though according to Splunk there a backwards compatibility for UFs. Downgrade was uninstalling v9.0.1, installing v8.2.5 and unzipping an old good backup of my v8.2.5 /etc folder. That made the trick. Hope it helps. If yes, a Karma would be appreciated 🙂 Christos ... View more

@isoutamo  In Search Job Properties under diskUsage I found exactly what I needed. Great tip! Thank you both @richgalloway and @isoutamo  🙂 ... View more

Thanks for your reply @richgalloway . How can I see every single sourcetype that is transferred between my indexers (deployment clients) and my search head (deployment server) split by host and total size in GBs? I would like preferably to see the data transferred from both sides. I mean sourcetypes and size of data transferred from indexers to search head and vice versa. Does the data travel compressed? Many thanks in advance. Christos ... View more

I would add a macro (eg. |`filtered_threat_activity`) in the end of the correlation search. In this macro add the filter you want to apply in order to get the wanted results only. Don't forget to change the permissions of the macro in order for it to work. Hope it helps. Christos ... View more

Hi @richgalloway, thanks for your answer. I believe this guide is approximately what you described? https://hurricanelabs.com/splunk-tutorials/your-guide-for-gathering-ldap-identity-data-with-splunk-cloud/ How can I write the |ldapsearch search results into an index? Is there an extra command for that? I will use the expected asset and identity fields in ES (bunit, owner, priority etc). Thanks again. With kind regards,  Chris   ... View more

Thanks for your detailed reply! Can't I use something like this in order to collect inputs from 2 network devices? [udp://123.456.789:514] index = networking sourcetype = cisco [udp://123.456.890:514] index = networking sourcetype = fortinet   514 should listen only to one input source? Will specifying the hostIP help in order to use more than one? Thanks! ... View more

Hello again, may I also request some help on extracting fields from these events of the same WAF? Fields: signature:  `New request from 127.0.0.1:52674` host: to include also dns name (eg. one.com:8080) New request from 127.0.0.1:52672 GET / HTTP/1.1 Host: one.com:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests: 1 New request from 127.0.0.1:52672 GET /resources/bootstrap.css HTTP/1.1 Host: one.com:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/css,*/*;q=0.1 Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://one.com:8080/ New request from 127.0.0.1:52674 GET /resources/floating-labels.css HTTP/1.1 Host: one.com:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/css,*/*;q=0.1 Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://one.com:8080/ Many thanks in advance. Chris ... View more

Grazie mille Giuseppe ... View more

Hello Giuseppe, thanks for your reply. So LDAPsearch is enough on my HF to connect to ADs and extract the info right? Do you know if it periodically queries and extracts this info? Many thanks. BR Chris ... View more

Hello, I have SA-LDAPsearch installed on my Heavy Forwarder. It then forwards all data to my Cloud Instance with Enterprise Security. Will this work in order to get my assets and identities populated? In Docs (https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.4/User/DeploytheSplunkSupportingAdd-onforActiveDirectory) I see that Heavy Forward is one option to install it, but respective table field is not checked. Will Heavy Forwarder has to have the Search Head role enabled in order to query the Domain Controllers? Thanks ... View more

I managed to have the script run after the Notable was triggered, but the script actually run on the machine where ES is installed. How can I get it run on the Indexer? Thanks ... View more

Hello, this works when manually triggering the script as splunk user (on the indexer directly). I know try to get the adaptive response action work. Question: the script should reside on Splunk ES or on remote indexer? Or normally it should replicated via the replication bundle? Thanks ... View more

I managed to create the following tstats command:   |tstats `summariesonly` count from datamodel=Intrusion_Detection.IDS_Attacks where IDS_Attacks.severity=high by IDS_Attacks.signature | `drop_dm_object_name(IDS_Attacks)'   I do get results in a table with high severity alerts. I created a test correlation search which fires a notable event, but it contains zero data on it. What shall I do in order to have all notable event's additional fields populated (if data exists) and also have the notable event's row in Incident Review, populated with src, dest (they are empty too)? Thanks, Chris ... View more

Hello again Giuseppe, Documentation states the following: "If the deployment server has less than 50 clients, you can co-locate the deployment server on an indexer or search head, including a distributed management console." In my environment, HF will only be used to forward events, therefore Search Head and Indexer roles will be disabled. Can this actually give me the "permission" to use more than 50 clients as a Deployment Server? If I use DS role does it automatically mean that Search Head role is also enabled? In other words, I do not want to use a UF as intermediate forwarder for the reasons you mentioned (single point of failure and throughput), therefore I want to use an HF to relay the data to my indexer and also manage the UFs on Endpoints. Regarding the license, I have an available license I can use on the HF (as DS requires an Enterprise License). Can I switch HF to a license slave and load the available license? Will this work? Thanks again, Chris ... View more

I found the answer for my 2nd question: https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/Distdeploylicenses ... View more

Hello Giuseppe, thanks for your quick reply. My HF will be used just as a relay; no data parsing - no indexing - no data routing - no filtering will be applied. 1. Why only 50? I have used a Deployment Server with managing more than 50 clients. Is this restriction because I am applying a double role (HF + DS)? Is there a documentation for it that I can use to support it to my management? 2. No indexing will be done on HF. If I understand well, no license is needed to operate HF as in intermediate forwarder? Thanks again for your support. Kind regards, Chris   ... View more