Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About markhill1
markhill1
Path Finder
Member since:
06-29-2017
10-23-2022
Community Statistics
| Posts | 34 |
| Solutions | 0 |
| Karma Given | 19 |
| Karma Received | 7 |
| Member Since | 06-29-2017 |
Activity Feed
- Posted Re: App Upgrade GUI on Splunk Enterprise. 10-21-2022 02:13 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 08-25-2022 08:07 AM
- Posted Re: Splunk GeoIP database on All Apps and Add-ons. 03-24-2021 06:46 PM
- Posted Re: Speedtest App Upload Value 1/6th of actual number on All Apps and Add-ons. 02-08-2021 03:38 PM
- Tagged Re: Speedtest App Upload Value 1/6th of actual number on All Apps and Add-ons. 02-08-2021 03:38 PM
- Posted Fields on All Apps and Add-ons. 09-29-2020 09:46 PM
- Tagged Fields on All Apps and Add-ons. 09-29-2020 09:46 PM
- Karma Re: Cannot get to Splunk Web interface for neelamssantosh. 08-11-2020 07:56 PM
- Got Karma for Re: Looking to fork the Speedtest app from Splunkbase.... 06-05-2020 12:50 AM
- Got Karma for Re: Config Documentation Sites Not Opening. 06-05-2020 12:50 AM
- Karma Using lookup table on multivalue field to exclude events for jpawloski. 06-05-2020 12:49 AM
- Karma Re: Splunk Restart Tracking for bandit. 06-05-2020 12:49 AM
- Karma Re: Warning message tracked down to Microsoft Cloud Services app for mbenwell. 06-05-2020 12:49 AM
- Karma "Brute Force Access Behavior Detected" from Microsoft domain controllers for dsuddu. 06-05-2020 12:49 AM
- Karma Refining Threat Activity Search for mtaylor78. 06-05-2020 12:49 AM
- Karma Is the webhook option supported for adaptive response actions in Enterprise Security? for tauricecobbins. 06-05-2020 12:49 AM
- Got Karma for Re: Unable to archive frozen data to s3. 06-05-2020 12:49 AM
- Got Karma for Re: does anyone know what is going on with splunk cloud it is down. 06-05-2020 12:49 AM
- Karma Re: Adding Melbourne and Sydney Australia as available time zones in GUI. for Lucas_K. 06-05-2020 12:48 AM
- Karma Re: how to get a list of skipped searches which are NOT REAL-TIME ?? for cmerriman. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-21-2022
02:13 AM
Hi, Did you find a solution to this? I am seeing the same thing on one of my lab machines. Thanks.
... View more
03-24-2021
06:46 PM
Hi, Actually it works with just the free sign-up, I have been using it that way for a long time now. Unless you are talking about the auto-update app they have for installing on your host machine. I haven't used that before. Thanks.
... View more
02-08-2021
03:38 PM
Hi Cameron, How odd! I'll take a look and see if I can find out what's happening. Weird.
... View more
- Tags:
- Speedtest
09-29-2020
09:46 PM
Depends on your setup, but I would say anywhere that you have the TA deployed
... View more
- Tags:
- Palo Alto
04-23-2020
03:28 PM
I'd be keen on seeing what you have as well, and contributing to its development.
I have actually started looking into changing the GP VPN dash (VPN Ops) in this app to display what it already has, but without the underlying data model that it uses from the Palo App.
Remote Work Insights. https://splunkbase.splunk.com/app/4952/
... View more
03-10-2020
02:33 AM
Very interesting! Might give it a go....
... View more
03-09-2020
03:01 PM
There is no way of currently doing that, feel free to give it a go, i'd be interested in seeing your approach.
... View more
03-01-2020
02:27 PM
There is an update coming, we have been working on it. I cant promise it will have what you want in the next update. But it will def be coming.
... View more
02-19-2020
04:40 PM
Hi All, I'm trying to get the IMAP Mailbox app working on our Phantom instance (4.6.19142) and we keep seeing errors.
Our config is 'outlook.office365.com:993' as the server/hostname and use SSL is ticked.
Testing Connectivity
App 'IMAP' started successfully (id: 1582158372604) on asset: 'imap-splunk-alerts'(id: 14)
Loaded action execution configuration
Error connecting to server. [Errno -2] Name or service not known. Connectivity test failed. No action executions found.
We have no firewall rules in place that may stop the connection.
nc -zvw 1 outlook.office365.com 993
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to 40.100.151.226:993.
Ncat: 0 bytes sent, 0 bytes received in 0.07 seconds.
What is weird is that we aren't seeing any traffic at all on port 993 or port 143 (when specified) when we run a tcpdump.
This should be the simplest thing on earth to get working, but so far a solution has eluded us.
Any advice would be gratefully received. Thanks.
... View more
- Tags:
- IMAP Mailbox
- phantom
11-18-2019
04:27 PM
Hi, We have a search running that does the same thing. Here is the base for it, add in any other groups you need to.
Or, convert it to use a lookup table of AD Groups instead,
index=wineventlog sourcetype="XmlWinEventLog:Security" EventID=4728 (Target_User_Name="Domain Admins" OR Target_User_Name="Enterprise Admins" OR Target_User_Name="DHCP Administrators" OR Target_User_Name="DNSAdmins" OR Target_User_Name="Schema Admins" OR Target_User_Name="Cert Publishers")
For local admin accounts, see this post
https://answers.splunk.com/answers/770820/example-of-a-new-local-admin-account-use-case.html
... View more
09-16-2019
04:51 PM
1 Karma
There was an email sent out this morning from Splunk, saying that 7.3.0 had been released?!?
Latest version available to download is now 7.3.0 and not 7.3.1?
What is happening? Very odd.
MuS, use your Fez and find out pls! 🙂
... View more
08-18-2019
09:43 PM
After I started ingesting the internal Phantom and Splunk logs into another Splunk machine I did some checking around.
Found that an incorrect label was causing the ingestion errors, but Im still getting the error above, every minute.
... View more
08-18-2019
08:26 PM
Hi all, Splunk 7.3.1, ES version 5.3.0, Phantom 4.5.15922.
I have ES configured to use the 'Send to Phantom' action for a couple of correlation searches.
But... I keep seeing this in the _internal logs and no events showing in Phantom.
ERROR phantom_forward:125 - /opt/splunk/etc/apps/phantom/bin/scripts/phantom_forward.py called without the correct set of parameters.
I have tried re-configuring the auth-token, and it tests fine.
Is anyone able to help on this one?
Thanks
... View more
Labels
- Labels:
-
troubleshooting
06-30-2019
02:47 PM
We are not. We are sending via a syslog-ng storebox, we are very aware of the right thing to do with syslog. Thanks.
... View more
06-26-2019
02:54 PM
Correct, its just adds in the idea of that imaginary first field. Thus moving all the other fields one place to the right.
... View more
06-25-2019
04:17 PM
Thanks, I'll raise a case with cloud ops to get this done, thanks for the response.
I'll let you know what happens.
Cheers
... View more
06-25-2019
04:16 PM
Hi, Our log formats are fine, here is an example:
09:13:34,013201007069,TRAFFIC,drop,2049,2019/06/26 09:13:34,38.126.xx.xxx,103.230.xx.xxx,0.0.0.0,0.0.0.0,Rule 278 Blocklist incoming,,,not-applicable,vsys1,Public,DMZ2,ae1.53,,Log Forwarding All,2019/06/26 09:13:34,0,1,46092,443,0,0,0x0,tcp,deny,64,64,0,1,2019/06/26 09:13:34,0,any,0,6693140560823890604,0x8000000000000000,United States,Australia,0,1,0,policy-deny,11,0,0,0,,FW01,from-policy,,,0,,0,,N/A,0,0,0,0
We found that the 'future_state_1' field the TA introduces was shifting all the field names over one spot to the right.
... View more
06-25-2019
03:49 PM
Hi all, After installing this TA recently, we discovered an issue, Its field extractions straight out of the box appear to be mis-aligned.
You need to remove the "future_use_1" from the start of the transforms. Then they all work fine.
If you don't, then all the other fields are mis-labelled, moved one spot over.
We are sending logs via syslog into Splunk rather than any other method, so not sure if that makes any difference.
Hopefully this helps someone else.
... View more
06-25-2019
03:39 PM
Hi Palo people, we are seeing thousands of errors from the various python scripts within the Palo Alto TA. (V6.1.1).
Examples:
ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" File "/opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/solnlib/packages/splunklib/binding.py", line 287, in wrapper
ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" File "/opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/modinput_wrapper/base_modinput.py", line 113, in stream_events
ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" File "/opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/splunktaucclib/global_config/configuration.py", line 264, in load
ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" self.parse_input_args(input_definition)
ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" HTTPError: HTTP 500 Internal Server Error -- {"messages":[{"type":"ERROR","text":"Cannot call handler 'Splunk_TA_paloalto_account' due to missing script 'Splunk_TA_paloalto_rh_account.py'."}]}
These are just some examples there are more. We have it installed one of the Splunk Cloud instances we manage.
The errors are coming from the indexers. We asked for it to be installed on our ES search head.
We aren't using the TA to pull any data in, we are just using it for the props and transforms on the ES search head.
It is also installed on the on-prem HWF.
Can you please let us know how we may be able to fix this?
Thanks.
... View more
05-23-2019
10:23 PM
I wouldnt disable the tag, you may prevent results appearing from important queries.
... View more
05-21-2019
07:58 PM
You dont need the index stanza in the inputs.conf, have you tried removing it?
Index is set in the Stream app when you create a group and new stream collection in the Stream app.
... View more
05-21-2019
07:54 PM
Have you tried removing the infra_dns from the stream_forwarder_id stanza in the inputs.conf?
Then restart the client instance. Go to the Distributed group you made in the Stream app and see if it appears in your available client regex area?
... View more
11-29-2018
02:01 PM
As far as my interactions with support have gone, it needs to be updated on the SH's and the IDX machines.
... View more
10-30-2018
03:06 PM
1 Karma
Hi @rlarkman_splunk, I'd be keen to breath some new life into this app with you, how do I get in contact with you?
Im in the process of transfering my older apps over to this login at the moment.
Cheers!
... View more
09-11-2018
05:49 PM
Hi, Are you able to post the final xml for the drilldown?
Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-23-2022
12:14 AM
|
Karma from
Karma given to
