Hi all, Is it possible to use inputlookup to pull a list of information from a scripted lookup? The documentation for inputlookup seems to suggest this is possible: The lookup table can be configured for any lookup type (CSV, external, or KV store)._ But the documentation for transforms.conf where the scripted input is defined states Your external lookup script must take in a partially empty CSV file and output a filled-in CSV file Which implies that it can't be used with a generating command like inputlookup. I'm trying to pull in a CSV from a threat intel feed but in a way that would allow me to do so using a scheduled search rather than a scripted input or modular input. Any thoughts on how best to do this if using a scripted input with inputlook isn't possible? ... View more

Anyone know if Splunk Stream can log the ciphers negotiated during a TLS handshake? I'm thinking about using it to detect when a LogJam (CVE-2015-4000) attack has occurred. I can't see anything relevant listed for SSL/ TLS in the doco, but I figure it doesn't hurt to ask: http://docs.splunk.com/Documentation/StreamApp/6.2.2/DeployStreamApp/Whattypeofdatadoesthisappcollect ... View more