I give you karma for this, i forget my client using Palo Alto to detect it. ... View more

Already install TA - Windows and restart in UF also installed it in Indexer but why i still cannot read the output ? did i forget to setting something ?  ... View more

Hmm so if one of endpoint got hacked and someone doing running script we cannot collect information from output in cmd/powershell ? ... View more

Thanks for your reply, i will try that before. If success i'll be back to Accept it as Solution so another people who have the same problem can use this step. Danke,  Zake ... View more

Thanks for your reply, i will try that before. If success i'll be back to Accept it as Solution so another people who have the same problem can use this step. ... View more

I create notable manually and i update next actions at the same time when i create notable ... View more

Anyone don't have same problem here ?  ... View more

Hi @smanojkumar  According in your information what if we create new field, let say max_length. put that field in condition then run the query like this index=03_f123456 sourcetype=logs* (CODE IN ($code$)) | eval code_list = split(trim("($code$)", "()"), ",") | eval lengths = mvmap(code_list, len(trim('code_list', '"'))) | eval max_length = if(mvfind(lengths, 1) >= 0, "value_1", "value_2") | table code_list max_length   Let me know if it works   Danke!       ... View more

Maybe you can add all your condition in 1 line ?  | where isnull(cliente) AND isnull(cliente1) AND Call.CallForwardInfo.OriginalCalledAddr="null"  Let me know if it works ... View more

Hi @smanojkumar  Maybe you can try this  index=03_f123456 sourcetype=logs* (CODE IN ($code$)) | eval code_list=split("$code$", ",") | eval x=mvcount(code_list) | eval y=if(x==1, "value_1", "value_2") | dedup y | table y   Let me know if it works ... View more

Idk where to ask, that's why i'm asking here. And still don't know how to solve this issue.  I'm just Path Finder splunk and don't have access to open ticket to Splunk principle, maybe it can be solved if you have Splunk Principle.  ... View more

im here still no idea for this issue ... View more

Note i'm using :  1. Splunk Enterprise Version : 9.3.1 2. Enterprise Security Version : 7.3.2   According to this documentation : https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/CompatMatrix  All is good, but i don't have any idea why this is happening.  ... View more

Oke Thankyou @isoutamo @PickleRick atleast in splunk can ingest everything. If want get specify data Analyst can regex it  ... View more

Hi @isoutamo  Thanks for your information, after i check it.  - Splunk Add-on for Unix and Linux [Installed] - Splunk Common Information Model (CIM) [Installed] - InfoSec App for Splunk [Not Installed] For the UF issue there is no problem at all, here I can get all the logs I need. It's just that the data I get has messy fields like this picture  I think it's not okay that's why i create topic for asking this problem   ... View more

Hi @PickleRick @marnall  Thankyou for your advice, but unfortunately i still can't change it even after i clear my cookies and/or cache. Can this issue solved using another method ? ... View more

I think there is no sensitive data, so here the full error message 2024-09-23 21:06:30,760 INFO [66f175e6c17fc8d479ab10] error:337 - 500 Internal Server Error The server encountered an unexpected condition which prevented it from fulfilling the request. 2024-09-23 21:06:30,760 ERROR [66f175e6c17fc8d479ab10] error:338 - Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 628, in respond self._do_respond(path_info) File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 687, in _do_respond response.body = self.handler() File "/opt/splunk/lib/python3.7/site-packages/cherrypy/lib/encoding.py", line 219, in __call__ self.body = self.oldhandler(*args, **kwargs) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/htmlinjectiontoolfactory.py", line 75, in wrapper resp = handler(*args, **kwargs) File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpdispatch.py", line 54, in __call__ return self.callable(*self.args, **self.kwargs) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-2042>", line 2, in help File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 41, in rundecs return fn(*a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-2040>", line 2, in help File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 102, in check if verify_session and not util.checkRequestForValidFormKey(requireValidFormKey=must_login): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 1481, in checkRequestForValidFormKey if not isValidFormKey(form_key) or not doesFormKeyMatchCookie(form_key): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 1452, in isValidFormKey logger.warn('CSRF form_key mismatch received=%s expected[redacted]=%s' % (key, getFormKey()[-4:])) TypeError: 'NoneType' object is not subscriptable Before that i would to say thankyou for reply this post and want to help me ... View more

i was download log file in `/opt/splunk/var/log/splunk/web_service.log` and i open with Notepad++ like this When i search 500 ERROR it showed too much data, could you please give me specify keyword? Because when i want to search macros it not show anything. Sorry very confuse about it    ... View more