This can happen when you're trying to send to an index that doesn't exist. You can confirm this by turning on logging to d_hec_debug in /opt/sc4s/env_file and looking at the index-named folder list in /opt/sc4s/archive/debug and confirming all of those indexes exist. Create the index or update splunk_metadata.csv to change the destination index for a given source key. Thanks mbonsack in the sc4s community slack channel for the guidance. Posting here for visibility/googling. ... View more

Answering my own question using the email sent in late July: Splunk recently released Add-on Builder v4.0.0 . If you built your Splunkbase solution with a prior release of Add-on Builder, please update your app(s) as soon as possible, and no later than August 31, 2021, using this latest version so that your Splunkbase app(s) will be compatible with the next major releases of Splunk Cloud Platform and Splunk Enterprise. As we move to newer versions of Python and jQuery in the platform, we have updated Add-on Builder to support them. That means that the current release of your application(s) based on the prior Add-on Builder release will not be compatible with the new Splunk releases coming later this year. You can find more information about this latest Add-On Builder release in the Splunk Add-on Builder Use Guide . To update your add-on, you will need to export your current project, then import it into this new Add-on Builder release. You can find more information in the “Import and export an add-on project ” section of the user guide. ... View more

Hi @phanTom  I don't actually want to call it from a custom function, I was just observing that you can't do that. I wanted to call another app's action from my custom app. I realised I could've just done a POST against /rest/action_run from my custom app to achieve what I was trying to do. ... View more

The json logged by Phantom break's Splunk's parsing. Early fields in the json will be available for you to search on, but later fields such as label and status won't be automatically extracted. I think the raw_email field is the one that breaks things. Based on a quick test, a json linter had no problem with what phantom was sending Splunk, so the issue seems more with Splunk parsing the dta. As a workaround - extract the relevant fields at search time (or define your own local props): index=phantom_container | rex "\x22label\x22: \x22(?<label>[^\x22]+)\x22" | rex "\x22status\x22: \x22(?<status>[^\x22]+)\x22" | search label!="servicenow-poll" status=new | eval _time = strptime(create_time,"%Y-%m-%dT%H:%M:%S") + 10*60*60 | stats min(_time) as _time, values(label) as label by id | timechart span=10m count by label   ... View more

We're working around this by using a Close Notable playbook that submits the following 'query' to Splunk: | eval event_id="{0}" | eval _key=event_id, rule_id=event_id, comment="Closing from Phantom", time=now(), status=5, user="admin" | table _key comment rule_id time status rule_name user | outputlookup append=true incident_review_lookup  Where {0} is filtered-data:filter_1:condition_1:artifact:*.cef.event_id and the filter is just locating the artifact with the event_id. ... View more

This feels hacky and wrong, but it works with your sample data and required outcome: \/(?<api_name>[^\/]+)(\/([a-z0-9]{32})|$) It works on the basis that you might have a 32 character hex string at the end, or might not - but you don't care what it is. As per comments from @richgalloway above, it's unclear what the rules should be for determining the value you're after. Here's that regex in action: | makeresults | eval U = "/my-web/services/v1/2/cartMetadata /my-web/services/v1/2/cartMetadata/delivery /my-web/services/v1/cps/getContent/8efa90da34cb4046ae0c65b2935ff5bc" | makemv delim=" " U | mvexpand U | rex field=U "\/(?[^\/]+)(\/([a-z0-9]{32})|$)" ... View more

(?<server_and_interface>[^\/]+)\.txt$ Here it is in action: | makeresults | eval source="/data/scripts/esx/outfile/dc1-ch1-esxi05.dca.com-vmnic0.txt" | rex field=source "(?<server_and_interface>[^\/]+)\.txt$" ... View more

December 2019 update Here's a working field_extraction_for_agt_risk transform in the symantec:ep:risk:file sourcetype: (?i)(?:[[sep_file_prefix]]),\s*(?<Risk_Action>[[sep_file_field]]),\s*(?:IP\sAddress:\s*(?<IP_Address>[[sep_file_field]]))?,\s*(?:Computer\sname:\s*(?<Computer_Name>[[sep_file_field]]))?,?\s*(?:Intensive\sProtection\sLevel:\s*(?<Intensive_Protection_Level>[[sep_file_field]]))?,?\s*(?:Certificate\sissuer:\s*(?<Certificate_Issuer>[[sep_file_field]]))?,?\s*(?:Certificate\ssigner:\s*(?<Certificate_Signer>[[sep_file_field]]))?,?\s*(?:Certificate\sthumbprint:\s*(?<Certificate_Thumbprint>[[sep_file_field]]))?,?\s*(?:Signing\stimestamp:\s*(?<Signing_Timestamp>[[sep_file_field]]))?,?\s*(?:Certificate\sserial\snumber:\s*(?<Certificate_Serial_Number>[[sep_file_field]]))?,\s*(?:Source:\s*(?<Source>[[sep_file_field]]))?,\s*(?:Risk\sname:\s*(?<Risk_Name>[[sep_file_field]]))?,\s*(?:Occurrences:\s*(?<Occurrences>[[sep_file_field]]))?,\s*(?<file_path>[[sep_file_field]]),\s*(?<Description>[[sep_file_field]]),\s*(?:Actual\saction:\s*(?<vendor_action>[[sep_file_field]]))?,\s*(?:Requested\saction:\s*(?<Requested_Action>[[sep_file_field]]))?,\s*(?:Secondary\saction:\s*(?<Secondary_Action>[[sep_file_field]]))?,\s*(?:Event\stime:\s*(?<Event_Time>[[sep_file_field]]))?,\s*(?:Event\sInsert\sTime:\s*(?<Event_Insert_Time>[[sep_file_field]]))?,\s*(?:End\sTime:\s*(?<End_Time>[[sep_file_field]]))?,\s*(?:Last\supdate\stime:\s*(?<Last_Update_Time>[[sep_file_field]]))?,\s*(?:Domain\sName:\s*(?<Domain_Name>[[sep_file_field]]))?,\s*(?:Group Name:\s*(?<Group_Name>[[sep_file_field]]))?,\s*(?:Server\sName:\s*(?<Server_Name>[[sep_file_field]]))?,\s*(?<user>[[sep_file_field]]),\s*(?:Source\sComputer\sName:\s*(?<Source_Computer_Name>[[sep_file_field]]))?,\s*(?:Source\sComputer\sIP:\s*(?<Source_Computer_IP>[[sep_file_field]]))?,\s*(?:Disposition:\s*(?<Disposition>[[sep_file_field]]))?,\s*(?:Download\ssite:\s*(?<Download_Site>[[sep_file_field]]))?,\s*(?:Web\sdomain:\s*(?<Web_Domain>.*))?,\s*(?:Downloaded\sby:\s*(?<Downloaded_By>[[sep_file_field]]))?,\s*(?:Prevalence:\s*(?<Prevalence>[[sep_file_field]]))?,\s*(?:Confidence:\s*(?<Confidence>[[sep_file_field]]))?,\s*(?:URL\sTracking\sStatus:\s*(?<URL_Tracking_Status>[[sep_file_field]]))?,\s*(?:First\sseen:\s*(?<First_Seen>[[sep_file_field]]))?,\s*(?:Sensitivity:\s*(?<Sensitivity>[[sep_file_field]]))?,\s*(?<Reason_For_White_Listing>[[sep_file_field]]),\s*(?:Application\shash:\s*(?<Application_Hash>[[sep_file_field]]))?,\s*(?:Hash\stype:\s*(?<Hash_Type>[[sep_file_field]]))?,\s*(?:Company\sname:\s*(?<Company_Name>.*))?,\s*(?:Application\sname:\s(?<Application_Name>[[sep_file_field]]))?,\s*(?:Application\sversion:\s*(?P<Application_Version>.*))?,\s*(?:Application\stype:\s*(?<Application_Type>[[sep_file_field]]))?,\s*(?:File\ssize\s\(bytes\):\s*(?<File_Size>[[sep_file_field]]))?(?:,\s*Category\sset:\s*(?<Category_Set>[[sep_file_field]]),\s*Category\stype:\s*(?<Category_Type>[[sep_file_field]]))?,?\s*(?:Location:\s*(?<Location>[[sep_file_field]]))? For reference, here were the field name changes: Inserted -> Event Insert Time End -> End Time Domain -> Domain Name Group -> Group Name Server -> Server Name Source computer -> Source Computer Name Source IP -> Source Computer IP ... View more