About marnall

marnall

Can you increment the checkpoint number by one before saving it using the helper functions in the add-on builder? This should prevent it from getting the last event multiple times when there are no new events after the last checkpoint.

marnall · ‎01-03-2025

According to the readme.md file, to configure it: On your Splunk instance navigate to `/app/KeycloakAPI_nxtp` to perform the configuration. I would assume this takes place after you install the app on your instance. Then you should be able to go to https://yoursplunk:8000/<locale>/app/KeycloakAPI_nxtp And there may be a setup page.

marnall · ‎01-02-2025

I've had this issue before with a custom app and tried recreating it from scratch to no avail. However, changing the locale in the URL (e.g. en-US to en-GB) somehow got the inputs page to load. Perhaps it will work for you.

marnall · ‎12-27-2024

This looks like it would work. If you're not quite sure and you want to make sure it is correct before the data goes into the index, then you could set up a sandbox index and use crcSalt to stop the logs from being registered as indexed already. In terms of billing, you would be paying for all logs, sandboxed or not, but it would avoid the annoyance of deleting wrongly-indexed data in your production indexes. E.g. [monitor://D:\Exchange Server\TransportRoles\Logs\*\ProtocolLog\SmtpReceive] whitelist=\.log$|\.LOG$ time_before_close = 0 sourcetype=MSExchange:2019:SmtpReceive queue=parsingQueue index=sandbox disabled=false crcSalt = "testing" (then remove or modify the crcSalt when the logs look good in the sandbox and are ready for production.)

marnall · ‎12-02-2024

When you run the command "netsh wlan show wlanreport", it does not only generate a HTML report, but also a xml report. This is good because the HTML report is intended for human consumption so Splunk will not be happy with it. You can instead index the XML file. The XML file is at: C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.xml To set up Splunk to generate and index this file once per hour, you need 3 configuration files: 1) A props.conf file on your indexer machine(s) # Put this in /opt/splunk/etc/apps/<yourappname>/local/props.conf [WlanReport] maxDist = 170 SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = <?xml version TIME_PREFIX = ReportDate> 2) A inputs.conf file on your forwarder machine(s) # Put this in /opt/splunkforwarder/etc/apps/<yourdeploymentappname>/local/inputs.conf [monitor://C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.xml] index=main sourcetype=WlanReport disabled = 0 initCrcLength = 256 # You can use a scripted input to run the command once per X seconds specified by the interval [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\<yourdeploymentappname>\bin\scripts\wlanreport.bat] interval = 3600 disabled = 0 # (I have trouble getting it to work with a relative path to the script) 3) The script file on your forwarder machine(s): # Put this in /opt/splunk/etc/apps/<yourdeploymentappname>/bin/wlanreport.bat @echo off netsh wlan show wlanreport You will then have events coming in containing the XML file contents, every hour.

marnall · ‎11-30-2024

Is there any pattern between the ticket type and the values appearing? E.g. does the Customer value always appear in Normal Tickets but never in Error Tickets? Or does it look random? Also when you say that "In Splunk, it is confirmed that the value exists", can you say it definitely exists for all records, even for the tickets that say it doesn't exist? Try running your alert search, but looking for rows where the field does not have a value. <yoursearch> | search NOT Client=*

marnall · ‎11-30-2024

If I understand correctly, you have a windows system with a logfile that does not have a long log retention time, so you cannot use the log file to look back very far, but you need to be able to look further back in time. This sounds like a straightforward use case for the Splunk forwarder. If you install the forwarder on the machine, then set up an input configuration to monitor that logfile, then the forwarder will send the log data to the Splunk indexers where it will be indexed and stored for longer times.

marnall · ‎11-26-2024

I also had this problem and managed to get the inputs page to load by changing the locale, specifically from en-US to en-GB. https://myserver.com:8000/en-US/app -> https://myserver.com:8000/en-GB/app Not sure if that fixes it on your end but its worth a try.

marnall · ‎11-26-2024

You probably want the Splunk Add on for Microsoft Azure (https://splunkbase.splunk.com/app/3757) There are set-up instructions described at https://github.com/splunk/splunk-add-on-microsoft-azure/wiki (see the sections on Configuration) on the right.

marnall · ‎11-25-2024

I have had this issue in the past where despite installing JDK, DB Connect will not recognize a task server. I ended up trying different versions of JDK until eventually I got one that worked. Could you try a few different JDK packages?

marnall · ‎11-19-2024

No you shouldn't need to enter it every time as an input. You can make custom add-on settings which are not username/password and then these will be set once on app configuration and can be re-used for inputs.

marnall · ‎11-18-2024

You may have better results by un-checking the "Global account settings" in Add-on setup parameters in the Add-On Builder and then adding your own Add-on Setup Components like a Text field for Client ID and a Password field for Client Secret, rather than attempting to re-name the account username and password.

marnall · ‎11-15-2024

I can't see any obvious issue with your code. What happens if you include debug log statements that output the report_id value, and then the resulting URL? Assuming logging mode is set to debug: helper.log_debug(f"Report ID is: {report_id}") url = f"https://example_url/{report_id}/download" helper.log_debug(f"URL is: {url}") headers = { "accept": "application/json", "Authorization": f"Bearer {jwt_token}", }

marnall · ‎10-28-2024

I recommend coding your modular input. You can use the page number as a checkpoint, then index a page and increment or decrement the checkpoint. Set an interval so that your input gets a page every X seconds, then has a condition to stop when the checkpoint gets to the end.

marnall · ‎10-19-2024

They seem to correspond to different Carbon Black products: https://splunkbase.splunk.com/app/5775 - Carbon Black App Control (formerly Bit9) https://splunkbase.splunk.com/app/5774 - Carbon Black defense https://splunkbase.splunk.com/app/5947 - Carbon Black Response https://splunkbase.splunk.com/app/6732 - VMware Carbon Black Cloud Which Carbon Black product are you using? If you have a contact with your Carbon Black license then perhaps you can ask them which is the most appropriate SOAR connector for your Carbon Black products. Or you could try your API keys on each product and see which one succeeds in its actions.

marnall · ‎10-15-2024

Do you see any more verbosity in the errors in the developer tools of your browser when making the upload, such as the network tab and the javascript console? Sometimes the errors there show more information but on the website itself you are only given a generic error message.

marnall · ‎10-09-2024

Try adding it as you would a header dictionary: headers = {"Authorization": "Bearer TOKENGOESHERE"}

marnall · ‎09-25-2024

It might be possible to hotwire the app, but you would void the warranty. It would also be worth reading through the terms of use to ensure you are not breaking it. The app itself should, in theory, provide code that makes an API call to the Splunk AI servers. I could not tell you for sure as I have only used the Preview version.

marnall · ‎08-07-2024

If I understand correctly, you would like your string to be converted into a .csv file, and attached to an email sent by SOAR? This would likely be a multi-step procedure: 1. Use a custom function to write the CSV to a temporary file on disk. 2. Use a custom function to call phantom.vault_add() to convert the temporary file on disk into a CSV in the vault. 3. Pass the ID of the file in the vault to the email action block as the attachment input. I personally have never gotten the SMTP app to successfully send file attachments, so I would recommend testing sending email with a file already in a vault before starting steps 1 and 2.

marnall · ‎08-07-2024

I couldn't tell you how to get it to work with makeresults, but if you input a CEF log with the sourcetype "cefevents", then the CEF field extractions should work.

marnall · ‎08-01-2024

I am surprised that the log export is not sending all logs. Which type of log is missing? Do you know if its possible to get this log through another integration or log collection setup from Github?

marnall · ‎07-31-2024

Is this a big app (e.g. bigger than 500MB)? If so, it takes time to upload using the webUI and you'll have to adjust the max upload size and timeout amount. If you use developer tools (F12) and go to Network, do you see any failed requests, or any responses that would indicate an error? Are you able to use the CLI of the server running Splunk Enterprise (if you are using on-prem) to un-tar the app into the /opt/splunk/etc/apps directory? This would bypass validation, but would install the app.

marnall · ‎07-24-2024

The developer of the app has decided to make the app restricted, so only approved users can download it. If you are a Hashicorp Vault Enterprise user, there are instructions under the Details tab of the splunkbase page with a link to the form for requesting access to the app.

marnall · ‎07-22-2024

So the action works when you run it ad-hoc on a container, but not from within a playbook? If so, could you try making the action name shorter?

marnall · ‎07-21-2024

Indeed, SOAR on-prem is in an awkward situation for OS support. SOAR on-prem only supports Amazon Linux 2, RHEL, or the end-of-support CENTOS. The SOAR automation broker runs on Debian, but that only helps you if you are using the Cloud version of SOAR. I believe there was some chatter in the #SOAR usergroup about adding support for 2 other CENTOS-related linux distros, but it's not there yet. You probably could get SOAR running on a distro similar to CENTOS, but you'd have to spend more time tinkering to get it working.

Posts	420
Solutions	47
Karma Given	56
Karma Received	119
Member Since	‎12-25-2023

Online Status	Offline
Date Last Visited	2 weeks ago

Re: Splunk Add-on Builder Checkpoint issues

Re: Help about keycloak configuration

Re: Splunk Add-On for Google Cloud Platform failin...

Re: Exchange 2019 - How to configure Edge Transpor...

Re: Application for collection logs

Re: Jira Service Desk simple AddOn sometimes sends...

Re: Application for collection logs

Re: Splunk Add-on Failed to load Inputs Page?

Re: How do I get Entra logs (formerly Active direc...

Re: Splunk DB Connect won't connect to task server

Re: Customize globalConfig.json

Re: Customize globalConfig.json

Re: Help with the Splunk Add-on Builder - creating...

Re: Splunk Add-on Builder - REST API input paginat...

Re: Which Carbon black app should be used in which...

Re: An unknown error while updating new version of...

Re: Using Bearer Authentication with addon_builder...

Re: Can Splunk AI Assistant be called using API ca...

Re: Playbook: How do I turn string into a CSV emai...

Re: how config to auto parser cef with just use kv

Re: Github Webhook

Re: Uploading new app hangs of "Package validation...

Re: Download Restricted

Re: Add Action to SOAR App

Re: Installation of SOAR on different linux versio...