Hi all  I recently upgraded my Splunk instance to version 8.x (whatever the newest one was a week ago). I reconfigured pretty much everything as I had it before  (on v7.x) and I have noticed I can no longer get my email notification to work.  I am using exactly the same settings for email as I used in version 7 but with version 8 I get these error messages :  ERROR sendemail:475 - (550, '5.7.60 SMTP; Client does not have permissions to send as this sender') while sending mail to: [email protected] I have configured Splunk to use our local exchange server for sending emails and its set to send emails as my self to myself. I have the correct settings/ports for TLS and the auth part, I have verified these settings using powershell and another python script and they both work, it's just Splunk that doesn't work.  I suspect that something is being changed when the sendemail attempt happens but I cannot see anything in the logs to see exactly what is being sent.   Any ideas on how to troubleshoot?  Looked in the splunkd.log and nothing really more than the above... ... View more

Trying to use the "Run Query" action from the Tanium app. The problem I am having is specifying the hostname to be searched. For example, this should be the search that gets sent to the server : Get Trace Executed Processes from all machines with Computer Name equals MyHostname1 Obviously, as this is part of the playbook I want the hostname to be filled in from the CEF|Artifacts field . Does anyone know if this is possible? Tried the below that didn't work: Get Trace .................. equals artifact.*.cef.sourceHostName ... View more

Hi all I'm having issues getting Afterglow to work on our dev Splunk instance. Currently running latest version of Splunk ( 7.1.1) on Windows and whatever version of Afterglow you download off the official website. I have installed ActivePerl and Graphviz and even added them to Windows PATH. Here is where the software is installed : Perl Location : C:\Perl64\ GraphViz Location :C:\Graphviz2.38\ Path entered into Afteglow Config ( App settings in Splunk) Perl : C:\Perl64\bin Graphviz : C:\Graphviz2.38\bin\ When performing a generic search on firewall logs its returning thousands of events however there is an error message that reads: AfterGlow was not able to generate a graph. Please check the neato directory in the AfterGlow Setup. Anyone have any idea how to fix this issue ? ... View more

Hi all We have a dev instance of Splunk we are using for testing. Splunk is installed on a Windows box and the service is running under the local system account. We have been trying to get Splunk to use our HTTP proxy with no luck .Below is what we have attempted so far: server .conf file : http_proxy=http://http-proxy-url:80 https_proxy=https://http-proxy-url:443 Splunk-launch.conf http_proxy=http://http-proxy-url:80 https_proxy=https://http-proxy-url:443 None of the above have worked, when trying to browse Splunkbase from within Splunk we get the below error : Error resolving: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server. And here have attached a couple of lines from Splunk log : splunkd.log 06-13-2018 11:32:16.446 +0100 INFO ProxyConfig - Failed to initialize http_proxy from server.conf for splunkd. Please make sure that the http_proxy property is set as http_proxy=http://host:port in case HTTP proxying needs to be enabled. 06-13-2018 11:32:16.446 +0100 INFO ProxyConfig - Failed to initialize https_proxy from server.conf for splunkd. Please make sure that the https_proxy property is set as https_proxy=http://host:port in case HTTP proxying needs to be enabled. Anyone got any ideas what we are doing wrong and how to fix ? ... View more