I honestly don't think you can the design of alert actions was to send the result to _internal its not a collection tool.  ... View more

I don't have a specific solution as you ask for but its a common practice to send events and receive results async so however you would collect events (file syslog hec) the response would come back over that method  ... View more

Looks like something is wrong on py2 I will try to get a look at it this month ... View more

Hi this is my app ,what version of Splunk are you using? ... View more

the original answer "no start TLS" is the correct answer. My response was to provide additional color to the reason for the question which is a vuln scanner is driving an incorrect response to "disable" ldaps. When the proper fix is simply to harden ldaps. ... View more

https://seckit.readthedocs.io/projects/splunk-ta-windows-seckit/en/latest/index.html ... View more

I generally use "appmsadmon" as the admon index ... View more

Because this is a new install I would suggest connecting with your SE who may recommend services time to assist in initial deployment. ... View more

You are asking multiple questions at once that are very vague. It would be helpful to have a question with each specific source you are working with allowing those with experience in specific technologies to help you. For the portion of your sources that happen to be syslog based connections you may want to check out the new Splunk Connect for Syslog https://splunk-connect-for-syslog.readthedocs.io/en/latest/sources/ ... View more

LDAPS as with most things (s) such as https the s stands for secure not SSL. The LDAP server configuration determines what crypto is offered and should be updated to only permit appropriately secure TLS options. "STARTTLS" is a potentially less secure choice where the server defaults to insecure communication and requires the client to request a step up to secure. This was a useful bridge for legacy communications such as LDAP, SMTP, and FTP but is not related to the need to remove support for older now less secure encryption protocols SSL* TLS 1.0 and TLS 1.1 Presuming your LDAP server is Microsoft Active Directory this vulnerability should be reviewed by your Active Directory admins to resolve. This may also be a great time to consider moving to SAML based authentication to reduce the risk of credential compromise via plain text bind. ... View more

Yes app developers are not able to proactivly ask cloud to approve if this version is useful to you then a ticket will be required ... View more

The client IP is based on what the tcp layer of the server sees, it could be the NAT or proxy address instead of the actual client ip. ... View more

the key proposition for Splunk is "native" or raw. If the source is natively producing json, xml or KV the best all things considered path is that raw form. Pre translation i.e. schema on write is very high risk and is the Achilles heal of other solutions identifying and rectifying data problems due to translation is difficult and often results in failure to monitor. If a new solution such as a business application was being implemented today and that solution was to log in a performant way to for example kafka or SNS I would use a minified json format, with a schema indicator. An example of this in use today is AWS cloud watch events. One example of things not to do is wrap a txt message in json for example packaging a Cisco ASA event inside of json requires escaping characters. Parsing fields from fields in json is very difficult. While a native Jason format is very easy to work with. ... View more

The way lookup files work is we will read the file until max_matches has been satisfied. If the file is sorted by reverse mask bits /32 /31 etc and max_matches=1 then this will appear to work. So long as only one row for a given cidr is expected. Lines #27 in this macro has an example https://bitbucket.org/SPLServices/seckit_sa_idm_common/src/f1abb1c9099be10a613c160a4b0d88088c0899c4/src/default/macros.conf?at=master&fileviewer=file-view-default ... View more

Hi, I'm the developer I normally track issues over in bitbucket or answer directly via email. Happy to help, when people hit me on the head I will look at answers but for all of the communications I get I just can't track it daily. ... View more

I would also be very concerned the NFS portion of this solution would allow for loss of logs if a close happens without the proper time for flushing to occur. Normally streaming to remote mounts is considered a bad practice. Consider the use of the splunk docker log driver for OS logs and other means of streaming delivery such rsyslog or HEC to avoid the file IO. ... View more

user_prefs should not be deployed via deployer remove shcluster/apps/user-prefs, deploy to peers, return to each peer and reinstall the rpm/tar to restore the missing files A few other things to check 1. review all contents of shcluster/apps ensure install_source_checksum is not present in default|local/apps.conf for any deployed apps if you have to clean up deploy to the cluster after cleanup actions. 2. Make sure the SHC members are not the client of a deployment server, if they are (deploymentclient.conf) remove this file and run a rolling restart. find and remove the deployment client artifacts left in opt/splunk/var ... View more

I apologize when I read your question I did not understand the error. Can you send me the search.log file from the SH and one indexer? Also list the mmdb files in the app directory ... View more

Per the documentation this is a macro not a command you must as with any search macro use the back tick ` please copy and paste spl from the documentation. ... View more

Just wanted to check did you get past this, if not send me a private message I can webex with you ... View more

This app is not implemented as a search command, we are using external lookup, I provided a macro which requires the back tick index=* sourcetype=mylogs earliest=-1h | `seckit_iplocation(ip)` ... View more

Notes this must be system local you can't include this setting in an app ... View more

verify the max mind files you are licensed for downloaded into the data folder. ... View more