About jtlittle

jtlittle · ‎07-23-2018

come on splunkers there is no support on this and AWS and splunk made the App... this is not acceptable we all should not have so many issues to use a basic app.

jtlittle · ‎05-16-2018

page does not exist!

jtlittle · ‎05-10-2018

this happens all the time when they truncate.

jtlittle · ‎03-13-2018

I tired this : param.process_event="red_alert" this is set as the alert action or the app name?

jtlittle · ‎03-08-2018

ok so the add-on builder does not do this for you? support has me using this https://splunkbase.splunk.com/app/2962/ I can check the alert_actions.conf I think ill need to SSH to it and use nano cause I don't recall that ability in the app. thanks for your recomendation ill try that. -Jon

jtlittle · ‎03-07-2018

what I find with Splunk and where my skill is. Everything is relatively time consuming and on developer level (using add-on builder/data enrichment[tag/normalize]) when it comes to enriching your data in order to get the alerts to correlate anything besides single sources (port activity) this is a result of missing some data which will make the cooler and more useful alerts fire.I think maybe the CIM is not being enriched by other sources of data. I see this alert first before anything else fire on my ES cloud stack. Really annoying but I consider it dumb alert that reminds me I need to focus on CIM data to show more enrichment by send different types of logs/sources/signals. I also copy my correlation searches to a wiki type thing and just check it once a week to see if I can add remove or update my rules for better alerting. at that point I can turn anything back on if testing didn't go as planned. (all in Dev)

jtlittle · ‎03-07-2018

I would just turn it off and work on actionable alerts. the data volume thats leaving is more interesting then the fact that ports are busy. I find if the built in alerts are noisy they need to be tuned and its easier for me to build out each alert based off technology stack then this type of single source signal. Maybe pair it with other data to have more relevance. Oh and what the guy ^^^ says about adjust it maybe if you know what to change it to.

jtlittle · ‎03-07-2018

anyone know why I cant execute filesystem commands in the app builder with python and slack web hooks? https://splunkbase.splunk.com/app/2962/ user log 1: 2018-03-07 18:34:42,033 ERROR pid=24690 tid=MainThread file=cim_actions.py:message:271 | sendmodaction - signature="Error: 'module' object has no attribute 'process_event'. Please double check spelling and also verify that a compatible version of Splunk_SA_CIM is installed." action_name="test_alert" search_name="test_arf" sid="1520447680.116" rid="0" app="TA-fancydudeapp" user="admin" action_mode="adhoc" action_status="failure" log 2: The os module/method can be used to execute filesystem commands.

jtlittle · ‎03-07-2018

I found this in the error logs. I am trying to just create alert actions to add .json alerts to each event I alert on. So its a python script which uses slack webhook to send the alert to with the crafted .json message. The `os` module/method can be used to execute filesystem commands. I would have an alert 1) alert action - slack alert with $ results.

jtlittle · ‎03-07-2018

this alert action gave me an error when testing the python. 2018-03-07 18:34:42,033 ERROR pid=24690 tid=MainThread file=cim_actions.py:message:271 | sendmodaction - signature="Error: 'module' object has no attribute 'process_event'. Please double check spelling and also verify that a compatible version of Splunk_SA_CIM is installed." action_name="test_alert" search_name="test_arf" sid="1520447680.116" rid="0" app="TA-fancydudeapp" user="admin" action_mode="adhoc" action_status="failure"

jtlittle · ‎02-14-2018

I have this App. https://splunkbase.splunk.com/app/3525/#/details Almost everyone does and I don't see how I can add my .json into the message body so this active action has my Splunk search results link or RAW log in the .json message. There must be a TAG I am not using because the script in this App has the JSON library in the code.

jtlittle · ‎12-05-2017

Anyone do anything really cool with Splunk and send to Slack alerts? Please share things you find useful!

Posts	12
Solutions	0
Karma Given	3
Karma Received	4
Member Since	‎10-14-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk - Add-on builder - cant execute webhooks

Why am I getting an error when creating Apps with ...

How do I add .json in slack messages from Splunk?

Slackalert: Do you have any pro tips for making us...

Re: How to install and configure Amazon GuardDuty ...

Re: Wrap a webhook for use with HTTP Event Collect...

Re: "Unable to parse message." for aws:config logs...

Re: Splunk - Add-on builder - cant execute webhook...