Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About wbcattell
wbcattell
Explorer
Member since:
09-06-2012
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 09-06-2012 |
Activity Feed
- Got Karma for port 8000 is SSL, port 8089 is not. 06-05-2020 12:46 AM
- Got Karma for Re: port 8000 is SSL, port 8089 is not. 06-05-2020 12:46 AM
- Got Karma for Splunk Forwarder port 9997 through firewall - bi-directional???. 06-05-2020 12:46 AM
- Posted Re: Splunk Forwarder port 9997 through firewall - bi-directional??? on Security. 06-11-2013 12:47 PM
- Posted Splunk Forwarder port 9997 through firewall - bi-directional??? on Security. 06-11-2013 11:42 AM
- Tagged Splunk Forwarder port 9997 through firewall - bi-directional??? on Security. 06-11-2013 11:42 AM
- Tagged Splunk Forwarder port 9997 through firewall - bi-directional??? on Security. 06-11-2013 11:42 AM
- Tagged Splunk Forwarder port 9997 through firewall - bi-directional??? on Security. 06-11-2013 11:42 AM
- Posted Re: port 8000 is SSL, port 8089 is not on Security. 12-05-2012 07:36 AM
- Posted Re: port 8000 is SSL, port 8089 is not on Security. 12-03-2012 01:26 PM
- Posted port 8000 is SSL, port 8089 is not on Security. 12-03-2012 08:12 AM
- Tagged port 8000 is SSL, port 8089 is not on Security. 12-03-2012 08:12 AM
- Posted Re: Linux server - Splunk Forwarder - './splunk list monitor' on Getting Data In. 11-26-2012 07:27 AM
- Posted Linux server - Splunk Forwarder - './splunk list monitor' on Getting Data In. 11-20-2012 12:03 PM
- Tagged Linux server - Splunk Forwarder - './splunk list monitor' on Getting Data In. 11-20-2012 12:03 PM
- Posted PCI CGI vulnerability on Splunk Dev. 10-30-2012 09:43 AM
- Tagged PCI CGI vulnerability on Splunk Dev. 10-30-2012 09:43 AM
- Tagged PCI CGI vulnerability on Splunk Dev. 10-30-2012 09:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
I need to submit firewall rules for our Splunk (Linux) Forwarders to connect to port 9997 on the indexers. Does this link need to be bi-directional?
Thanks,
Bill
... View more
12-03-2012
08:12 AM
1 Karma
I've set up our Splunk Web interface to use 3rd party signed certs. On a Nessus scan it's being found and is passing the scan ok. However the management port - 8089 continues to fail Nessus with a self-signed certificate.
Are there different settings or a different file in which to modify to secure the management port?
I've already read this but must have missed the answer;
http://splunk-base.splunk.com/answers/54133/how-do-i-set-the-ssl-cert-for-the-management-port-8089
Thanks,
Bill
... View more
- Tags:
- ssl
11-26-2012
07:27 AM
Thanks for the input. Tried that - came up with "invalid command: inputs".
I'm running forwarder version 4.3.4
... View more
11-20-2012
12:03 PM
When I login as Admin on one of my Splunk Forwarders (Linux, cmd line only) and issue the ./splunk list monitor command I see the list of monitors. No problem there. In which file are these monitors stored? I've looked in etc/system/local/inputs and outputs.conf but they're not there.
I also need to remove a couple of the monitors that display as we have moved the directories.
Any ideas, suggestions would be appreciated. I've already RTFM'd but didn't find the answer.
Thanks,
Bill
... View more
- Tags:
- forwarder
10-30-2012
09:43 AM
We're getting PCI security alerts on the Cherry web engine. Is there some method of resolving this issue - i.e. install a later version of the web engine?
Thanks,
Bill
Here's the alert:
Server IP = X.X.X.X
THREAT:When the service made an HTTP request for a CGI file that was found to
exist on the Web server host, the Web server returned an HTTP redirection page
containing unsanitized user-supplied input to at least one of the CGI file's
parameters. Thus the host is vulnerable to cross-site scripting attacks.
A list of CGI vulnerable files can be found in the Result section below.
IMPACT:By exploiting this vulnerability, malicious scripts could be executed in
a client browser which processes the content of an HTTP redirection page
returned by the Web server.
SOLUTION:Contact the vendor/author of the CGI file(s) for a solution to this
issue.
RESULTS:GET
/en-US/search?client="> alert(document.domain) &site="> alert(document.domain) &output="> alert(document.domain) &q="> alert(document.domain) &proxystylesheet="> alert(document.domain)
HTTP/1.1
Host: X.X.X.X:8000
HTTP/1.1 303 See Other
Date: Wed, 04 Jul 2012 19:12:56 GMT
Content-Length: 618
Content-Type: text/html;charset=utf-8
Location:
http://X.X.X.X:8000/en-US/search/?client="> alert(document.domain) &site="> alert(document.domain) &output="> alert(document.domain) &q="> alert(document.domain) &proxystylesheet="> alert(document.domain)
Server: CherryPy/3.1.2
Set-Cookie: session_id_8000=b35a7fbfe22ca405f9db492b63aa1544f6aa0846;
expires=Thu, 05 Jul 2012 19:12:56 GMT; httponly; Path=/
This resource can be found at
href='http://X.X.X.X:8000/en-US/search/?client="> alert(document.domain) &site="> alert(document.domain) &output="> alert(document.domain) &q="> alert(document.domain) &proxystylesheet="> alert(document.domain) '>http://X.X.X.X:8000/en-US/search/?client="> alert(document.domain) &site="> alert(document.domain) &output="> alert(document.domain) &q="> alert(document.domain) &proxystylesheet="> alert(document.domain) </a
... View more
