i wanted to get below logs from sql server. who has accessed the database recently - what change has been made on the database recently - which new user has been created on the DB recently   Splunk Add-on for Microsoft SQL Server : do not give above logs. Please suggest ... View more

Same here, they maybe deleted ... View more

A list of all CIM fields (with mapping to corresponding  data model they are used in) are available in CIM documentation since 4.15.0 version: CIM App documentation -> Data Model -> CIM fields per associated data model https://docs.splunk.com/Documentation/CIM/4.18.0/User/CIMfields   ... View more

Does anyone has luck on this? i am trying to configure JMX input to Splunk Kafka add on. couldn't see options to add servers etc. I have both JMX and Kafka addons loaded into Splunk also could see JMX add-on working fine and fetching the metrics. Its just that unable to connect Kafka add-on to JMX add-on ... View more

We have a Tomcat running and to collect JMX logs is it mandatory to have Heavy forwarder installed.?I know we cannot install JMX add-on for UF. Is there any alternative method other than having HF installed.?and catalina,localhost,and manager logs can be collected through UF right.?correct me if I am wrong ... View more

Thank you, yes it was version related. Once I did a Splunk restart, the "old" jar file was picked up and it all worked as required. Thanks ... View more

The ServiceNow alert actions should already be available to be triggered as adaptive response actions from correlation searches, provided that the permissions are set correctly so that the ServiceNow alert actions are available to all apps. However, in order to get them to appear as an option as an ad-hoc adaptive response from the Incident Review dashboard, you'll need the param._cam, which you can add on your own instance: Follow the docs to do this here: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBG ... View more

Happy to help. The fix is working for me. Thank you. ... View more

I don't believe Splunk Enterprise is supported on Windows 8 per http://docs.splunk.com/Documentation/Splunk/7.1.2/Installation/Systemrequirements#Windows_operating_systems It looks like compatibility with Windows 8.1 is deprecated but still supported on a trial or free installation. Maybe you could try that? ... View more

To get the data in splunk i installed the addon all the endpoints which has the input config scripts. ... View more

That is in service_now.conf but if you are using the Deployer for this, then you must manually put in the *un*encrypted password before pushing it out (unless you syncronized splunk.secret across all SHC members). Each member will encrypt it on next restart. ... View more

Thank You! ... View more

Even I am getting 401 error on Akamai side.When sending data.I can not even look through any of the logs.X-splunk-request channel is necessary for 7.1.2 ,because I saw in the documentation that it is not necessary for greater than 6.7 ... View more

The Splunk Add-on for Cisco ESA is not intended to be visible in Splunk Web, so there is no UI to show. When a non-visible add-on is accidentally set to be visible, you'll see the kind of behavior you've described. To turn off visibility: 1. Go to Apps > Manage Apps. 2. Find the row for the add-on you are working with and click Edit properties. 3. Under Visible, choose No, then click Save. (Reference: http://docs.splunk.com/Documentation/AddOns/released/Overview/Troubleshootadd-ons#Check_if_the_add-on_is_intended_to_be_visible_or_not) If you are looking for instructions on how to configure this TA, start here: http://docs.splunk.com/Documentation/AddOns/released/CiscoESA/Installationsteps ... View more

For documentation on the naming convention and how to import custom apps that don't meet that convention, see http://docs.splunk.com/Documentation/ES/4.7.4/Install/ImportCustomApps ... View more

No use case... I was just curious why there was a type for IPv4 but it wasn't used for src/dest. Since you work for Splunk... The Network Sessions data model uses src_ip/dest_ip. The Network Traffic model uses src/src_ip/dest/dest_ip. All the other ones use src/dest. These should be consistent across all data models. Also... The Authentication data model's "action" field expects success/failure as the field values. The Change Analysis data model's "action" field expects created/deleted/modified/updated/etc and the "status" field expects success/failure. Using "action" in two different data models where the data model expects different values is a huge pain in the ass. It basically requires creating a field like "change_action" and then modifying the data model logic for the action field. I try to avoid modifying the data models if possible... ... View more

Look at macros.conf in the CIM app. There is a macro for each datamodel, which defaults to some incantation of everything . You can set this to a search that excludes indexes, or includes, or whatever else you want to put in there that is a valid search. ... View more

Hello Daniel Where you able to get anything similar to what you were asking? I am also looking on such a document or anything close. Let me know if you did. Thanks ... View more

@cusello Can you provide specific location for apps and addons to be present for single instance deployment and for first time.? ... View more

Rocky31, I suggest that you browse the apps and add-ons available on Splunkbase to find the ones that are relevant for the data that you want to ingest and the use cases that you plan on using the Splunk platform for. One good starting point might be the Splunk Add-on for AWS: https://splunkbase.splunk.com/app/1876/ ... View more

I get that there is a current definition. But what do I do if the results seem wrong? For example Palo Alto Traffic logs get mapped to the Network Traffic datamodel. But all start and end records for the same session are mapped as separate Network Traffic entries. This means that I have at least two Network Traffic entries per actual event. But the problem gets worse since many Palo Alto traffic logs contain multiple starts To see this, try the following query on the Network_Traffic datamodel: |tstats summariesonly=t count as sameCount from datamodel=Network_Traffic.All_Traffic where All_Traffic.session_id>100000 by All_Traffic.session_id All_Traffic.src_ip All_Traffic.src_port | eventstats count as total | stats count values(total) as total by sameCount I ran this against 9/9/17 8:40 - 9/9/17 8:41 (one minute) in my environment and get the following sameCount count total 1 22826 35598 2 12202 35598 3 526 35598 4 18 35598 5 18 35598 6 3 35598 7 5 35598 So 35598 Network Traffic events. Of those 5 sessions included 7 Network Traffic events 3 sessions included 6 Network Traffic events 18 sessions included 18 Network Traffic events ...etc and these numbers are low, because they don't count the Network session that did not end in the minute queried What kinds of problems does this cause? 1) I am misrepresenting any summary statistics since some stats will repeat for each session 2) I have no way of comparing start or end times (without massive processing). So searching for things like beaconing cannot account for intervals Based on these problems, it seems that there must be a better way to map the logs to Network_Traffic. That is why I am asking. ... View more

Hi cwilmoth: I met similar problems like you, the data model WEB can not be accelerated. But it works opposite to yours. the WEB completes the accerleration immediately and it shows 'done'. But indeed it did not accelerate anything. I copy the WEB to WEB2, and it works fine. Did you solve this problems? ... View more

Hi rpille, I see the below error i n python.log ,when i setup the add-on. 2017-03-30 13:11:46,364 ERROR Run function: delete_password failed: Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password all_passwords = self._storage_passwords.list() File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list return list(self.iter(count=count, **kwargs)) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter items = self._load_list(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list entries = _load_atom_entries(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries r = _load_atom(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom return data.load(response.body.read(), match) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load root = XML(text) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML parser.feed(text) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed self._raiseerror(v) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror raise err ParseError: not well-formed (invalid token): line 33, column 37 . 2017-03-30 13:11:46,365 ERROR Run function: set_password failed: Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 138, in set_password self.delete_password(user) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password all_passwords = self._storage_passwords.list() File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list return list(self.iter(count=count, **kwargs)) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter items = self._load_list(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list entries = _load_atom_entries(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries r = _load_atom(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom return data.load(response.body.read(), match) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load root = XML(text) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML parser.feed(text) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed self._raiseerror(v) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror raise err ParseError: not well-formed (invalid token): line 33, column 37 . 2017-03-30 13:11:46,366 ERROR Run function: update failed: Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/conf_manager.py", line 251, in update encrypt_keys) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/conf_manager.py", line 110, in _encrypt_stanza self._cred_mgr.set_password(stanza_name, json.dumps(encrypt_fields)) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 138, in set_password self.delete_password(user) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/utils.py", line 150, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/solnlib/credentials.py", line 179, in delete_password all_passwords = self._storage_passwords.list() File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1459, in list return list(self.iter(count=count, **kwargs)) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1419, in iter items = self._load_list(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 1325, in _load_list entries = _load_atom_entries(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 201, in _load_atom_entries r = _load_atom(response) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/client.py", line 196, in _load_atom return data.load(response.body.read(), match) File "/opt/splunk/etc/apps/TA-ciscoAMP4ep/bin/ta_ciscoamp4ep/splunklib/data.py", line 77, in load root = XML(text) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1300, in XML parser.feed(text) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1642, in feed self._raiseerror(v) File "/opt/splunk/lib/python2.7/xml/etree/ElementTree.py", line 1506, in _raiseerror raise err ParseError: not well-formed (invalid token): line 33, column 37 ... View more

I downvoted this post because it doesn't even begin to answer the question. the new version in the comment is also incompatible with es and requires hacks to make it work ... View more