According to the SentinelOne Upgrade Documentation for v3.6, they are suggesting the following: Distributed deployment (8.x) Heavy Forwarder: IA-sentinelone_app_for_splunk (IA-sentinelone_app_for_splunk) Search Head: (Pre-requisite) Splunk CIM Add-on SentinelOne App (sentinelone_app_for_splunk) Indexer: TA-sentinelone_app_for_splunk (TA-sentinelone_app_for_splunk)Question:  Does the "IA-sentinelone_app" need to be installed on the HF? Can the TA-sentinelone be installed on the HF instead?  Note: The customer does not want index time extractions. ... View more

Good Day, I am trying to come up with ideas to translate a Sumo Trasactional search with (States) Conditions to a Splunk Query.  If anyone can provide some other options, please let me know.   Here is my sample Sumo search: _sourceCategory=prod/app/m/* and "statement" and ("Search Keys" or "STATUS=ERROR" or Error) | parse "[ID=*]" as MID nodrop | transactionize MID (merge MID takeFirst, _raw join with "\n\n") | transaction on ORGID, EVENT, ORDER, FACILITY with "*A request to obtain a channel subscription failed*" as NO_SUB, with "*M cannot be discontinued*" as NO_DC, with "*Person not found*" as NO_PERSON | (NO_SUB + NO_DC + NO_PERSON) as Total | fields ORGID, EVENT, ORDER, FACILITY, Total, NO_SUB, NO_DC,NO_PERSON | sort by Total, ORGID, EVENT, ORDER //| sort by ORGID, EVENT Splunk Search so far: index=hhh_m_prod sourcetype=mirth* MID=* CID=* acctnumber=* facility=* orgid=* "Statement" ("Search Keys" OR "STATUS=ERROR" OR "Error") | fillnull value="NULL" | transaction MID | eval NO_DC=if(match(_raw, "M cannot be discontinued*"), "Yes", "No") | eval NO_SUB=if(match(_raw, "A request to obtain a channel subscription failed*"), "Yes", "No") | eval NO_PERSON=if(match(_raw, "Person not found*"), "Yes", "No") | transaction ORGID EVENT ORDER FACILITY | eval Total=sum(NO_SUB, NO_DC, NO_PERSON | table ORGID, EVENT, ORDER, FACILITY, Total, NO_SUB, NO_DC,NO_PERSON  | sort by Total ORGID EVENT ORDER | sort by ORGID, EVENT ** I am lost for ideas in running the conditional transaction statements... Should I use more eval statements, or setup a transactiontypes.conf?   ... View more

I am trying to use the case match command with more than one option. I keep getting an error message regarding the parenthesis.. nothing is working.. Do not understand whats missing from the syntax.   Here is the search --> | eval state_ack_error=case(match(_raw, "ACK\-CODE\=AA"), 1, match(_raw matches "STATUS\=SENT"), 1, 1=1, 0) Error message: Error in 'eval' command: The expression is malformed. ... View more

Requesting assistance with removing characters from logs during search time.  Sample Data:  "{"log":"{\"@t\"😕"2021-12-15T16:26:36.1571090Z\",\"@m\"😕"\\\"http\\\" \\\"GET\\\" \\\"/api/v1/" Trying to remove the extra \ \\ that came with the data via HEC. ... View more

Good Day, I am new to SPL searches for AWS logs and I do not have access to the aws:config:rule logs. Can someone assist with creating a search query to find if "the AWS ELB Logging is enabled/disabled"? ... View more