I am trying to configure NEAP policy action rules  to integrate servicenow incident comments by passing a token, but it looks Splunk doesn't support tokens in NEAP action rules. I heard there is some custom script would pass the tokens, does anybody have idea on this customization part and how we can achieve it ? ... View more

We have enabled Bidirectional correlation search for Service now in our ITSI, unfortunately  itsi_notable_event_external_ticket  lookup is not updating proper values. I couldn't find the saved search which is used to update the lookup to troubleshoot further. Can some one tell me how itsi_notable_event_external_ticket lookup is being updated ? ... View more

Can any one tell me, What is KV store ? How does it useful in cluster environment ? Through the docs, I am not getting clear understanding! ... View more

ERROR:bamboo:Failed on request: Traceback (most recent call last): File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/bamboo.py", line 180, in get_bamboo_plans resp = requests.get(translated_url, **args) File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/libs/requests/api.py", line 67, in get return request('get', url, params=params, **kwargs) File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/libs/requests/api.py", line 53, in request return session.request(method=method, url=url, **kwargs) File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/libs/requests/sessions.py", line 468, in request resp = self.send(prep, **send_kwargs) File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/libs/requests/sessions.py", line 576, in send r = adapter.send(request, **kwargs) File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/libs/requests/adapters.py", line 447, in send raise SSLError(e, request=request) SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:676) . ERROR:root:Get error when collecting events. Traceback (most recent call last): File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/libs/modinput_wrapper/base_modinput.py", line 173, in stream_events self.collect_events(inputs, ew) File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/bamboo.py", line 266, in collect_events self.sync(ew) File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/bamboo.py", line 115, in sync plans_data = self.get_bamboo_plans(data) File "/users/splunk/az/splunk/etc/apps/ta-bamboo/bin/bamboo.py", line 196, in get_bamboo_plans raise e SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:676) ... View more

How do I calculate the Enterprise security App license usage ? Is it different from the Spunk Enterprise license ? Does the ES app use the base indexes of Splunk Enterprise or does it contain separate indexes ? ... View more

(I have created a macro and changed the permissions to appropriate users, now I want to change the owner to some other user but I don't see that option available in GUI. Search heads are in cluster.) ... View more

I have below configuration in Splunk_TA_Windows inputs.conf to blacklist the NT AUTHORITY\SYSTEM events in 4663 code. But my blacklist3 is not working as expected, still I get the events indexed. Can some one help me in resolving the issue ? [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist3 = EventCode="4663" Message="Security ID:(\w[NT]\s\w+.\w+) renderXml=false index = winlogs ... View more