Hi folks, My environment is collecting windows security event and use Splunk Add-on for Microsoft Windows. Collecting events are indexed with below source and sourcetype. source=“XmlWinEventLog:Security” sourcetype=“XmlWinEventLog" I'd like to confirm my events with security essential app rules but search is based on different source name like below SPL. Of course, just modify SPL on this page is easy but I'd like to avoid modifying every time to see this page or other windows security based sample searches. How to change or rename (eval or aliases) source with few step of works? Thanks, Satoshi ... View more

I setup G Suite app and TA in single Splunk server (7.0.0) to collect google drive access log among of all team usage. I setup step by step like below Install App and TA Setup Client ID and Client Secret Setup Authorized step1 and step2 Create a new input (check only Activity - Drive) Error messages was appeared What is the meaning of ga.py error? When I type below command with CLI, then no response after a minute and type Ctrl+C, error message was appeared. [root@ip-172-31-16-21 bin]# /opt/splunk/bin/splunk cmd python ga.py ^CTraceback (most recent call last): File "ga.py", line 246, in <module> run() File "ga.py", line 74, in run MI.start() File "/opt/splunk/etc/apps/GSuiteForSplunk/bin/ModularInput.py", line 468, in start self.run() File "/opt/splunk/etc/apps/GSuiteForSplunk/bin/ModularInput.py", line 477, in run self._config = self._get_config() File "/opt/splunk/etc/apps/GSuiteForSplunk/bin/ModularInput.py", line 387, in _get_config config_str = sys.stdin.read() KeyboardInterrupt Does anyone know how to solve this type of error? ... View more

I consider the way to forward kv store data on HWF to splunk cloud . My understanding is if I want to forward indexed data then define with inputs.conf on HWF. Can we monitor KV sotre data and forward to splunk cloud? The reason why I confirm this topic is I'd like to collect threat intelligence via minemeld, then I choose "Palo Alto Add-On" to collect minemeld data, but threat intelligence data will be gather into kvstore basically. https://splunk.paloaltonetworks.com/autofocus-and-minemeld.html If the "Palo Alto Add-On" can not forward kv store data into splunk cloud, I'd chose the other Splunk App such as "REST API Modular Input". Thanks, Satoshi ... View more

Hi teachers, Now I seek how to deploy savedsearches.conf to single SH (not SH cluster) via splunk function. The reason why I seek is I'dl like to share the schadule search and alert function to 2 or more single SHs server with automatically. My understanding is - If the SH cluster then use deployer But if the single SH then use anything? deployment server or OSS? Thanks, Satoshi ... View more