@tskubisz This will give you a walkthrough on how to generate it all for Splunk https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Howtoself-signcertificates Yes, the certificate needs to be on the Device sending the syslog, go through this document for a thorough walkthrough https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/ConfigureSplunkforwardingtousesignedcertificates Validation step: https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Validateyourconfiguration ... View more

Splunk export to pdf functionality has limited capability. Try this app and see if it solves the issue https://splunkbase.splunk.com/app/4030/ ... View more

Yes, that is the case, as the data is not mapped -> Go to Settings -> Data Model -> and check for the Web Data Model (DM) Now you will need to look into constraints section which defines how the DM is being populated At this stage you may have a list of indexes and source types that populate the Web DM (keep this for later [1], if not its fine) In order to map the use this docs page as its a really good walkthrough https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime The indexes / sourcetypes / tags from [1] will assist identifying which apps provide the data that populate the DM. If there were none, you will need to identify which of the sourcetypes from the data you're currently ingesting are relevant to the DM and follow the process. The modified / created eventtypes.conf, tags.conf and props.conf will become part of /local for each of the app for which you're mapping to the Web DM Once you push out the new conf files, you will need to restart Splunk (applies to eventtypes and tags) Though before you do that, you would want to validate that the props which map to the "site" field or any other key is working as expected. So execute | extract reload=true and then in a new tab, run the spl index="indexName" sourcetype="updateMappedSourcetype" earliest=-1h latest=now | stats values(site) as site by _time restart Splunk SH and you should see the site mapped | tstats values(Web.site) as site from datamodel=Web by sourcetype index You can repeat the rest for other sourcetypes ... View more

glad you got that sorted ... View more

thanks @nickhillscpl ... View more

If you need to go via the WMI route, use this docs to help you get started https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWMIdata You can do this with just the UF. So, if you've the capability to install UF's (preferred method) then get the Splunk_TA_Windows https://splunkbase.splunk.com/app/742/ Docs for setting it up the app https://docs.splunk.com/Documentation/MSApp/2.0.0/MSInfra/DownloadandconfiguretheSplunkAdd-onforWindowsversion6.0.0orlater On your cloud instance you'll have the Universal Forwarder app, which will provide you the config to send data to the cloud. You might need to raise a Splunk support ticket to have the app deployed on Splunk Cloud, so the data can be parsed correctly. Now, if you're planning to collect windows data at scale, it would also be ideal to look at setting up a deployment server and pushing out the configurations via that. This will help with centralised management. ... View more

Also, why have the NOT "http:/pinky/confirmcustomer" the search string already specifies what to include, it will exclude the confirmcustomer url unless your _raw consists of both urls in the same event ... View more

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/Table look at Command Type sub heading. The alternative is the fields command. Note: the table is just displaying the results in a tabular format. If you want to output the result into a csv file look at @rich7177 comment. ... View more

If it is the same data then send it two different instances using the UF: https://answers.splunk.com/answers/92257/can-single-forwarder-forward-data-to-two-different-indexers.html If its different source types: 0) Ideally, discuss about centralising Splunk in the organisation as various teams are utilising Splunk. 1) Create a new Indexer with two different indexes and set permissions accordingly. 2) Install two UF's based on other recommendations below 3) send the data to both indexers and use transforms to send security data to null queue for other team (tedious and will open up security data to other team, if they change things in the conf file -- conduct your risk analysis) ... View more

Refer to this wiki article first: https://wiki.splunk.com/Community:HowIndexingWorks You will see that transforms comes in much later on in the pipeline. It's not a config that will end up on the UF to append the FQDN at the UF, it happens at the Indexer tier. You can create a lookup table to fix this issue, though this would be ongoing maintenance: 1) Create a search to output all the host in a table 2) Export the host list and create a new column, which has the FQDN entry 3) Import the lookup file onto the SH to an existing / new app 4) Run the lookup search as part of the spl and it will return thee FQDN value Alternatively (preferred), you can do it to OS way, more work initially though this will help create a consistent process https://answers.splunk.com/answers/45899/how-can-i-use-the-fully-qualified-domain-name-fqdn-as-the-host-value-for-var-log-messages.html ... View more

Here: splunkURL:8000/en-GB/manager/launcher/saved/searches?app=&count=10&offset=0&itemType=&owner= search for the scheduled alert and click Edit Alert. Scroll down to the Trigger Actions section and update the mailing details as required ... View more

This will help you get started In order to enable the team to add comments, you would want to create a new html panel, which has the following functionality: 1) create a KV store which stores reference to the unique identifier for the result along with the comment column 2) on click of the above panel, it populates the the html panels fields with the comment and reference to the _key field 3) allow the user to update the comments only 4) on clicking the save / update button, a search runs in the background which updates the KV store row using the _key reference and then also refreshes the initial panel Once the JS and HTML are working, 1) Update your search to include | lookup to the KV store and returns the comments added by the team ... View more

From here https://www.splunk.com/page/previous_releases ... View more

I had modified the path, have reset it back to what you're using. Check again. ... View more

Config you need, on the syslog: - inputs.conf [SSL] serverCert = .pem sslPassword = requireClientCert = true outputs.conf [tcpout] sslPassword = clientCert = .pem useClientSSLCompression = true server.conf [sslConfig] serverCert = .pem sslRootCAPath = .pem sslPassword = This is for the certs only, include other key/pair as required ... View more

For the second part, read this docs page, which will explain how the drill downs work: https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/DrilldownIntro With the drilldown a new panel(s) will be populated at the bottom of the dashboard or in a new dashboard. Examples of drilldown you can add: - identify the user groups which make most use of the printer - identify the last known fix action on each of the printer - identify the list of common issue with the printer - identify the jobs that were executed in the last 24hrs which lead to the printer's current fail state - display the maintenance history of the printer This can assist further with troubleshooting and also ongoing maintenance. Note: these are just examples and you should extend the capabilities as per requirements ... View more

Have not come across such a feature in Splunk. What you can do is create a Global time filter for the Dashboard and pass the token to each panel. You will need to update and save the global time token on a monthly basis to set the time range as required. ... View more

The format command might be what you're looking for: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Changetheformatofsubsearchresults ... View more

Refer to this https://answers.splunk.com/answers/399429/splunk-local-account-login-to-splunkweb-when-saml.html ... View more

You can start by creating a lookup table which has all the list of protocols and create a dropdown list on the dashboard. You can then pass on the value from the dropdown to the panel. Make sure you use $protocol|s$. The |s is to add quotation mark to the string <form> <label>Token Example</label> <fieldset submitButton="false"> <input type="dropdown" token="protocol" searchWhenChanged="true"> <label>Protocol</label> <choice value="ssh">SSH</choice> <choice value="sftp">SFTP</choice> <choice value="http">HTTP</choice> <fieldForValue>protocol</fieldForValue> <search> <query/> </search> </input> </fieldset> <row> <panel> <title>Token Examplle</title> <table> <search> <query>| makeresults | eval protocol_value = $protocol|s$ | table protocol_value</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> Your search can then be modified to use the protocol token being passed, to give you the desired output ... View more

| makeresults | eval jsonTest = "{ \"parent_id\": 1, \"child_info\": [ { \"id\": \"123\", \"status\": \"PASS\" }, { \"id\": \"456\", \"status\": \"FAIL\" }, { \"id\": \"457\", \"status\": \"FAIL\" } ] }" | spath input=jsonTest path=parent_id output=parent_id | spath input=jsonTest output=id_initial path=child_info{}.id | spath input=jsonTest output=status_initial path=child_info{}.status | eval val = mvzip(id_initial, status_initial) | mvexpand val | eval mvVal = split(val, ",") | eval id = mvindex(mvVal, 0) | eval status = mvindex(mvVal, 1) | stats count(eval(status=="PASS")) as Child_Passed_count count(eval(status=="FAIL")) as Child_Failed_count by parent_id parent_id Child_Passed_count Child_Failed_count 1 1 2 ... View more

You can run a real time search via the CLI to troubleshoot the issue ./splunk rtsearch 'index=_internal' sourcetype=splunkd -earliest_time 'rt-30s' -latest_time 'rt+30s' If the app install had some issue, you can run the same from the CLI ./splunk search 'index=_internal '' -earliest_time 'time of install' -latest_time 'T+5m' -preview true ... View more

See if this can help you diagnose further: https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/TroubleshootSAMLSSO ... View more

Write a saved search that executes on a cron schedule ? The result can then be displayed based on requirement (dashboard panel / email etc.) ... View more