Can you please state where exactly you added lines 2-4? Did you add the bracket to the end of the file or did you insert it all at lines 2-4?   Additionally, don't forget to re-add the tags file for CIM purposes. ... View more

I had it from a while ago. It was in their documentation from v3.5 under support. They probably prefer users to use TAC though. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreCLIOperationsGuide_354.html ... View more

I emailed encore-community@cisco.com notifying them on 12/10, as well as to change the splencore.sh to reflect the correct path for cleaning. They said they would fix on the next upgrade. I also noticed there are other issues such as the knowledge bundle sizes that are being created. I think it's best to roll back for now until they fix all other issues. ... View more

You could use v6, but you would have to bypass the pre-requisite checks. However, please note that you have to complete certain steps prior to deploying v6. Right now, I personally feel it isn't worth the headache. I've come across various issues with dashboards and data not ingesting correctly. ... View more

Thank you. That is what I did for now. However, I was hoping to keep the table format. Hopefully, in the future Splunk allows more options and/or customization for emails. ... View more

The problem isn't the records. The issue is that in the emails I want the table to be vertical and not horizontal. If I use the transpose in the search, an email is produced for each field in the table. So there would be an email for time, another for event_id, another for hostname, and so on. ... View more

alert search: dvc_plug_success which is: index=epo source=epo prod_action=Block threat_type="Device Plug" | eval et_time=strftime(_time, %m/%d/%y %H:%M:%S") | table time, event_id, hostname, ipaddress, domain, username, bus_type, dev_plug_utc, threat_vector, threat_type, product_action, dev_class_name,dev_desc,dev_name,dev_compatible_id, dev_instance_id, pci_vendor_id, pci_device_id, usb_class, usb_vendor_id, usb_product_id, usb_serial, fs_type, fs_state, fs_vol_serial, fs_vol_label Alert settings are: alert type: real-time trigger alert when "Per Result" Actions: Send Email Message: default email alerts To include: link to alert, link to results, Inline: Table, Attach PDF Type: HTML&Plain Text Let me know if you need anything else. ... View more

When you tried to recreate the cert, did you try to run another test? I had the same issue, and ran a test after I recreated the cert. It then prompted me to reprocess the cert, and to enter the password. It worked after that. For some reason in the GUI, the re-process doesn't work. ... View more

molinarf, i read your other post. Have you tried recreating a NEW cert with a password? Once you do that, you can try running the test again unless you continue to get the argparse error. ... View more

Molinarf, were you able to resolve the issue? I am curious to know what the solution was. ... View more

So I had the same error, "Unable to read password from console. Are you running as a background process?" Here's what I did to troubleshoot: CLI into the Splunk server where the TA-eStreamer app is located. Go to "cd /opt/splunk/etc/apps/TA-eStreamer/bin" In the splencore.sh, you may need to edit "#SPLUNK_HOME=/opt/splunk" by removing the #, or set it to Splunk directory. Run the script: "./splencore.sh test" It may tell you that the certificate needs the password. Enter the password if prompted. Once completed, end the script. Check your eStreamer Summary Dashboard if it's running. If disabled, go back to the Splunk eStreamer app setup page and try reprocessing the certificate. This is how I got mine to work. Good luck! Also, you can check out this page for a step by step install: http://www.thesecurityblogger.com/configuring-cisco-firepower-estreamer-with-splunk-7/ ... View more

Which logs are you trying to obtain? Performance logs or CIFS logs? NetApp CIFS: https://answers.splunk.com/answers/386482/how-to-configure-splunk-to-index-netapp-cifs-logs.html Otherwise, you can take a look at forwarding the Syslog of that Netapp to Splunk, or you could send it to a Syslog server and have Splunk monitor the file. ... View more

Take a look here: https://answers.splunk.com/answers/386482/how-to-configure-splunk-to-index-netapp-cifs-logs.html One issue I am having is being able to parse the xml fields. ... View more

Can you please elaborate? I am having the same issue. I have researched throughout Splunkbase, and I haven't had any success by adding the line to JVM options or modified the db_connections.conf file. Appreciate it. ... View more

Thank you. I will have to look at setting up a HF. Just seems inconvenient to do this for this one thing. However, I am hoping the outcome will be worth it. Appreciate your help! ... View more

Our environment contains: Nessus Pro Vulnerability Scanner 6.5.6 (less than 1000 systems scanned) Splunk Enterprise 6.5.3 Search Heads Enterprise Security Indexes Deployment Server Universal Forwarders I believe Nessus 6.5.6 still contains the REST API functionality. If I can get away with a Universal Forwarder, I would prefer that for now. Thanks for the help! ... View more

Thank you, however, I was looking for something similar to this: https://answers.splunk.com/answers/22589/what-are-the-splunk-product-guids-for-use-with-windows-msi-installations.html I just needed the version 6.4.3. ... View more