cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
jpondrom_splunk
Splunk Employee
Member since: ‎10-03-2017
‎06-05-2020
Community Statistics
Posts 7
Solutions 1
Karma Given 12
Karma Received 20
Member Since ‎10-03-2017
Activity Feed
View All

Re: Azure AD SSO to F5 SP

by Splunk Employee in Getting Data In
‎03-14-2019 09:39 AM
1 Karma
‎03-14-2019 09:39 AM
1 Karma
In talking with some folks I think we found a good way to approach this and make it work for you. If you can restrict the roles being sent to Splunk to be less than 150 per users, then Azure will not send the url and actually send the roles for Splunk to map. The normal approach taken is to leverage Azures Application Roles This issue can be worked around by leveraging "Application Roles" in Azure instead of Azure AD Groups. This is done by: 1. 1) Configuring appropriate Application Roles on the Azure side 2. 2) Updating the Splunk SAML configuration "Role Alias" to use: http://schemas.microsoft.com/ws/2008/06/identity/claims/role 3. 3) Creating SAML groups to match the Application Role names https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles This should get you a valid workaround to the issue you are facing if needed never hesitate to open a support case. We are here to help make you a success with Splunk. ... View more

Re: Azure AD SSO to F5 SP

by Splunk Employee in Getting Data In
‎03-14-2019 09:25 AM
1 Karma
‎03-14-2019 09:25 AM
1 Karma
While I have never run into this one myself, I am aware of the issue. Azure AD limits the number of objects it includes in the groups claim. If a user is a member of more groups than 150 for SAML, then Azure AD does not emit the groups claim in SAML Assertion. Instead, it will replace the group attribute (usually named http://schemas.microsoft.com/claims/groups) with a group.link attribute (http://schemas.microsoft.com/claims/groups.link) that will contain a link back to https://graph.windows.net//users//getMemberObjects. This will cause the role mapping on the platform to be ineffective for the user the Assertion is applicable to. Maybe filtering the number of groups passed in the assertion would work, however, I am not sure how best to approach that. There is currently an enhancement request opened to have a way to work around this Microsoft limitation added to Splunk. ... View more

Re: How do I test connectivity over a specific por...

by Splunk Employee in Getting Data In
‎10-19-2018 11:37 AM
15 Karma
‎10-19-2018 11:37 AM
15 Karma
You can run the PowerShell equivalent command of telnet (Test-NetConnection) to test network connectivity over a certain port in windows. The command is below. Test-NetConnection -Port 9997 -ComputerName Test-NetConnection -Port 9997 -ComputerName jpondromidx Test-NetConnection - 10.1xx.xx.xxx:9997 Attempting TCP connect Waiting for response A sucess looks like the following. PS C:\Users\jpondromfwd> Test-NetConnection -Port 9997 -ComputerName jpondromidx ComputerName : jpondromidx RemoteAddress : 10.xxx.xx.xxx RemotePort : 9997 InterfaceAlias : Wi-Fi SourceAddress : 10.xx.xxx.xxx TcpTestSucceeded : True A failed test looks like the below. PS C:\Users\jpondrom> Test-NetConnection -Port 9997 -ComputerName jpondromidx2 WARNING: TCP connect to (10.xxx.xx.xxx : 9997) failed ComputerName : jpondromidx2 RemoteAddress : 10.xxx.xx.xxx RemotePort : 9997 InterfaceAlias : Wi-Fi SourceAddress : 10.xx.xxx.xxx PingSucceeded : True PingReplyDetails (RTT) : 46 ms TcpTestSucceeded : False ... View more

How do I test connectivity over a specific port in...

by Splunk Employee in Getting Data In
‎10-19-2018 11:21 AM
3 Karma
‎10-19-2018 11:21 AM
3 Karma
My forwarder is unable to establish a connection over port 9997 to my indexer. I am running Windows, and I do not have telnet installed. I have access to powershell. Is there a connectivity test I can run in powershell to check to ensure traffic can be passed over TCP to a specific port? It would be 9997 in this case. I see the Tcpout processor has paused the flow of data as an error in the splunkd.log on the forwarder. ... View more

Re: DBX will not load after update to 3.1.3. Canno...

by Splunk Employee in All Apps and Add-ons
‎08-08-2018 07:25 AM
‎08-08-2018 07:25 AM
This is caused by a compatibility issue between TA-Proofpoint-TAP 1.3.117 and DBX 3.1.3. To work around the error, and resolve the issue please downgrade the TA-Proofpoint-TAP to version 1.0.1 ... View more

DBX will not load after update to 3.1.3. Cannot co...

by Splunk Employee in All Apps and Add-ons
‎08-08-2018 07:22 AM
‎08-08-2018 07:22 AM
When running Splunk 7.1.2 and splunk_app_db_connect 3.1.3 and TA-Proofpoint-TAP 1.3.117 it keeps DBX from loading. With the below error. Cannot communicate with task server, please check your settings. Traceback (most recent call last): File "/opt/splunk/bin/rest_handler.py", line 79, in print splunk.rest.dispatch(**params) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 149, in dispatch module = __import('splunk.rest.external.%s' % parts[0], None, None, parts[0]) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxproxy.py", line 7, in from dbx_settings import Settings File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxsettings.py", line 10, in import splunklib.client as client File "/opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/splunklib/_init.py", line 18, in from splunklib.six.moves import map ImportError: No module named six.moves ... View more

Re: Field extraction in a string

by Splunk Employee in All Apps and Add-ons
‎10-24-2017 07:27 AM
‎10-24-2017 07:27 AM
You will need to make an adjustment to fields.conf on the search head. Setting the INDEXED_VALUE to false should allow you to search on the extracted fields without the wild card. If one does not exist, you will want to create a fields.conf in $splunkhome/etc/system/local and add the below stanza to it. [ertyuio or whatever your extraction is named.] INDEXED_VALUE=false This should then allow the env=ertyuio search to return results. Below is a link to the docs page for fields .conf http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Fieldsconf This is what we are changing, it is a bit counter intuitive, though ertyuio is in the event, since it is part of a word and does not exist exactly as "ertyuio" we want to set it as false as it does not count as being part of the raw text in the event. INDEXED_VALUE = [true|false||] * Set this to true if the value is in the raw text of the event. * Set this to false if the value is not in the raw text of the event. Give that a try for me if you can and let me know your result. It works in my test environment. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM