We are using a search head cluster and we are having an issue with the following workflow. A user has lookup table that is private. The user is trying to change permissions for the lookup table from private to app. The following error appears: Splunk could not update permissions for resource data/lookup-table-files [HTTP 409] [{'text': 'Cannot overwrite existing app object', 'code': None, 'type': 'ERROR'}] I have tried global as well with no change. Any ideas? ... View more

I am trying to use syslog forwarding to send Windows event data to RSA Analytics and it is not working. Any ideas? This is just for systems events as a test, but I intend to use this for application and security logs as well. props [source::wineventlog:system] TRANSFORMS-rsa = send_to_rsa transforms [send_to_rsa] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = rsa any ideas? Is using syslog forwarding the preferred way to integrate with RSA Analytic or would the CEF app be a better option. Thanks! ... View more

I am getting unknown command. I exported the app globally so I do not think this a permissions issue. ... View more

We have a subscription for MaxMind and I am trying to figure out how to use the ISP and Organization fields from the database. Can iplocation be extended for new fields, or do I have to build an TA? Thanks! ... View more

I need to produce an extract to use as a data source for a third party application. The application needs the data in a csv format and required data from two sourcetypes. I can search for one sourcetype and then append the second search, but the tabled output is uneven. Here is an example - I need for two data sets to be merged. index=os host=xxxxxxx sourcetype=puppet_facts | dedup host | append [search index=os host=xxxxxxx sourcetype=package | multikv | dedup VENDOR,NAME,VERSION ] | table host,Domain,server,manufacturer,User,operatingsystem,VENDOR,NAME,VERSION needed output format - host,Domain,server,manufacturer,User,operatingsystem,VENDOR,NAME,VERSION - (i am ignoring the Domain and User field right now ) results host01 Cisco Systems Inc RedHat host01 Red Hat, Inc. redhat-lsb 4.0 host01 Red Hat, Inc. infinipath-psm 3.0.1 How do I combine the output for row and 2 for every result to like this? host01 Cisco Systems Inc RedHat Red Hat, Inc. redhat-lsb 4.0 host01 Cisco Systems Inc RedHat Red Hat, Inc. infinipath-psm 3.0.1 Also - is it possible to hardcode certain values? For example host,Domain,server,manufacturer,User,operatingsystem,VENDOR,NAME,VERSION so the output would be host01 Domain server Cisco Systems Inc User RedHat Red Hat, Inc. redhat-lsb 4.0 Thanks for any feedback! ... View more

Hello, I am trying to setup a nullQueue for Windows security events we do not care to index into Splunk and my configuration is not working. I am using the below on the Indexer and restarted Splunk. I do not see any errors and I am not sure how else to troubleshoot the issue. The sourcetype in the props matches the sourcetype of the data. Any feedback is most appreciated. props.conf [WinEventLog:Security] TRANSFORMS-WinEvents=eliminate-eventcodes transforms.conf [eliminate-eventcodes] REGEX = EventCode=(5156|4656|33205|5158|577|578|5157|5145|4769|4768|5145|4634) DEST_KEY = queue FORMAT = nullQueue ... View more