About irsysintegratio

splunkreal · ‎07-18-2024

Hi @woodcock this is old topic however just want to know if pushing addon from deployer using encrypted credentials in new local/passwords.conf (previously encrypted by clustered search head) is different in term of behavior than configuring addon on search head (web UI) and letting SHC replicating passwords.conf?

whrg · ‎01-06-2021

I encountered the very same error. I was following this guide: https://www.splunk.com/en_us/blog/tips-and-tricks/write-your-own-search-language.html What I noticed was that this guide is from 2008. Newer version of Splunk already have a built-in "shape" command. This one is defined in etc/system/default/searchbnf.conf: [shape-command] syntax = shape <field> (maxvalues=<int>)? (maxresolution=<int>)? shortdesc = Produces a symbolic 'shape' attribute describing the shape of a numeric multivalued field. Apparently, the built-in shape command takes precedence over your custom shape command when running a search. So I suggest rename your "shape" command to "shape2" or something else.

irsysintegratio · ‎04-18-2019

We are developing a ModularAction using the CIM framework, and we want to know how to get the following information: trigger_date trigger_timeHMS trigger_time These are the possible tokens user can enter into the config according to this doc: https://docs.splunk.com/Documentation/Splunk/7.2.5/AdvancedDev/ModAlertsLog#Pass_search_result_values_to_alert_action_tokens Thank you very much in advance!

ddrillic · ‎12-04-2017

@irsysintegration, push it using $Splunk_Home/bin/splunk apply shcluster-bundle -target https://<Search Head Host>:8089 .

simon_lavigne · ‎09-09-2019

Thanks @jawaharas, just so happens I'm fault finding the TheHive add-on too

lfedak_splunk · ‎09-25-2017

Hey @irsyintegration, which add-on are you referring to?

irsysintegratio · ‎09-14-2017

Ok, answering my own question. One way to contribute. 🙂 Need to set the following env var: SPLUNKD_URI to the FQDN of your machine. Then it will work.

jstoner_splunk · ‎07-11-2017

The default correlation would show in threat activity dashboard as well as would generate a notable event provided the correlation search is enabled and configured. There is a bit of housekeeping that is performed to prepare the data. I would take a look at the threat gen saved searches within ES, specifically Threat - Source And Destination Matches - Threat Gen and take a look at the search interval and also the search to ensure it runs. You can also look at the threat activity data model data and see what is in there as this is where the correlation search looks.

swapspkr · ‎01-02-2020

Getting same issue . how to upload the custom app on splunk cloud.

plucas_splunk · ‎09-11-2017

But new code should use v2.

Posts	25
Solutions	2
Karma Given	0
Karma Received	8
Member Since	‎06-30-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to get information in ModularAction

Encrypted information from deployer to search head

How to use deployer to push app to the search head...

Splunk Enterprise Security: Adaptive Response Acti...

Help with Add-on permissions

Port issue with splunkd SSL

Splunk Enterprise Security: Do I need to create a ...

How to install this App to my Splunk Cloud free tr...

Re: Encrypted information from deployer to search ...

Re: Error occured during do run "Custom search com...

How to get information in ModularAction

Re: How to use deployer to push app to the search ...

Re: Splunk Enterprise Security: Adaptive Response ...

Re: Help with Add-on permissions

Re: Port issue with splunkd SSL

Re: Splunk Enterprise Security: Do I need to creat...

Re: How to install this App to my Splunk Cloud fre...

Re: Custom search command always shows Statistics ...