About chillsgrove

chillsgrove · ‎02-21-2020

Yes. Here is the solution that worked for us: Option 1: In your authorize.conf file you have a stanza named [role_system_admin] remove the next two attributes: edit_roles_grantable = enabled grantableRoles = system_admin These lines were required in the older versions of Splunk. Now however they are causing the issues you are seeing. It is recommended to make a backup of the file, remove these two lines, and then restart Splunk. This will need to be done on all of your search heads. NEXT STEPS In your SH diag, I see that in authorize.conf, under the [role_admin] stanza edit_roles_grantable = enabled grantableRoles = admin Please edit etc/system/local/authorize.conf and from the [role_admin] stanza, remove the line grantableRoles = admin Restart Splunk on the SH Login to the SH as an admin user and check if missing users are visible.

chillsgrove · ‎11-20-2019

Using the rest api command I get a return result of 292 users. However, in the $SPLUNKHOME/etc/users directory there are 451 users listed. I'm missing about 159 users in the GUI.

chillsgrove · ‎11-19-2019

We have almost 500 Splunk users in our organization (a mix of local and LDAP). About 200+ of our Splunk users are no longer appearing in the "User" tab under Access Control. A mix of both local users and LDAP users are not visible however they are still able to login to Splunk and use it without issues. Unfortunately I'm not able to administer their account through the GUI though. We are using a search-head cluster on Splunk v7.3.2. I've already logged into each individual search-head and verified they are missing from all of them. Any advice to point me in the right direction on how to solve this is greatly appreciated.

chillsgrove · ‎04-17-2018

We have configured a MINT data input using a project's data collector token in a heavy forwarder to pull the data from the MINT console into our Splunk enterprise environment and it works fine. However, we have recently configured a second MINT project with a separate MINT console account and a different data collector token on the same heavy forwarder, but unfortunately, the data never makes it into the mint index. We've setup the configurations for both projects almost the same (minus the different data collector tokens of course). We can't seem to figure out why the data pulls for one but not another. Has anyone experienced this before or has any idea of how to tackle this?

chillsgrove · ‎03-07-2018

Hi! I'm referring to a ad-hoc search widget inside of a glass table. A timechart is one of the "Viz Type" options, however, the y-axis range is dynamic. I'm hoping there's a way to make it static.

chillsgrove · ‎03-06-2018

I've created a glass table to display system memory and CPU usage by percent using the Timechart visualization option. I want to set the y-axis range 0 - 100 so that the timecharts are consistent with how they show spikes. Although this is easy to due in Splunk's Visualization editor, unfortunately I don't see an option to do this in the glass table configuration interface (unless I'm missing it somehow). Does anyone know how to set the y-axis range in the glass table?

chillsgrove · ‎02-05-2018

Thank you. This worked perfectly.

chillsgrove · ‎01-16-2018

I'm attempting to create an automatic lookup that matches src_ip, dest_ip, and signature in returns a "reason" and "status" field. The events always contain src_ip, dest_ip, and signature. In the lookup table, we may have src_ip, dest_ip, and/or signature but not all three are required. Example lookup "whitelist.csv" dest_ip,src_ip,signature,reason,status 8.8.8.8/32,0.0.0.0/0,456789,False Positive,Y 0.0.0.0/0,128.72.21.3,987654,Deemed Safe,Y 128.72.56.48,128.72.110.0/24,,Permitted,Y I've already performed match typing in transforms.conf (see below) [whitelist] filename = whitelist.csv match_type = CIDR(src_ip) match_type = CIDR(dest_ip) match_type = WILDCARD(signature) What I need to happen is for the automatic lookup to match the "reason" and "status" fields based on the combination of src_ip, dest_ip, and signature (note: I'm using the CIDR notation 0.0.0.0/0 to indicate all IPs when the source or destination doesn't matter accordingly). I thought this solution would work but the automatic lookup just isn't functioning. Any assistance provided is greatly appreciated.

chillsgrove · ‎07-13-2016

Thank you. I ran the search you provided. Had problems with the "lookup threat_ip_list.csv src_ip as ip_address" and "lookup threat_ip_list.csv dest_ip as ip_address" lines. But I worked around it by adding src_ip and dest_ip fields in the lookup table and giving them equivalent ip values and removing the "as ip_address" from the search string. Everything else worked great!

chillsgrove · ‎07-12-2016

I want to create an alert that triggers when a src_ip OR dest_ip exists in a lookup table (e.g. threat_ip_list.csv). But I'm not sure how to create the search string for this. The fields I'm using in the threat_ip_list lookup table are as follows: src_ip, dest_ip, threat_country, threat_name (NOTE: The src_ip and dest_ip field values are duplicates of each other in the lookup table.) If the src_ip OR dest_ip matches an IP address listed in the table, the alert should trigger and provide the threat_country and threat_name information. Any recommendations on how to do this are greatly appreciated.

Posts	10
Solutions	1
Karma Given	0
Karma Received	5
Member Since	‎09-18-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Users missing from Access Control

Splunk MINT configuring inputs from multiple MINT ...

Setting static Y-Axis range for Timechart used in ...

Automatic Lookup matching on multiple fields

Alert if src_ip or dest_ip exists in lookup table

Re: Users missing from Access Control

Re: Users missing from Access Control

Users missing from Access Control

Splunk MINT configuring inputs from multiple MINT ...

Re: Setting static Y-Axis range for Timechart used...

Setting static Y-Axis range for Timechart used in ...

Re: Automatic Lookup matching on multiple fields

Automatic Lookup matching on multiple fields

Re: Alert if src_ip or dest_ip exists in lookup ta...

Alert if src_ip or dest_ip exists in lookup table