Can you increment the checkpoint number by one before saving it using the helper functions in the add-on builder? This should prevent it from getting the last event multiple times when there are no new events after the last checkpoint. ... View more

I am glad it is working 🙂 ... View more

In what format are you adding that link? If it is using <A> tags, or you can otherwise control the attributes of the link, then you can add a target="_blank" to it to make it open a new tab by default. <a href="linktowebsite.com" target="_blank">Link</a> ... View more

I don't have Splunk running on a windows machine so I can't comment on whether those files are necessary or not, but if you find that your splunk installation is working well without those files and then you would like to just disable the warning, then you can remove the related lines in the manifest file in your splunk directory to disable the integrity checking on them. ... View more

According to the readme.md file, to configure it: On your Splunk instance navigate to `/app/KeycloakAPI_nxtp` to perform the configuration. I would assume this takes place after you install the app on your instance. Then you should be able to go to https://yoursplunk:8000/<locale>/app/KeycloakAPI_nxtp  And there may be a setup page. ... View more

Splunk will store the indexed data until the end of the retention period in the index. You cannot tell Splunk to just store the latest copy from inputs.conf. You can, however, use searches to return only the latest indexed event. By default, events will be returned in reverse chronological order. So if your list of certificates is in a single event, then you may be able to filter to only the latest one by using "head 1" index=test_event source=/applications/hs_cert/cert/log/cert_monitor.log | head 1 | rex field=_raw "(?<Severity>[^\|]+)\|(?<Hostname>[^\|]+)\|(?<CertIssuer>[^\|]+)\|(?<FilePath>[^\|]+)\|(?<Status>[^\|]+)\|(?<ExpiryDate>[^\|]+)" | multikv forceheader=1 | table Severity Hostname CertIssuer FilePath Status ExpiryDate If this is not the case, then perhaps you could post a sanitized screenshot of your events to give us a better idea of how they appear in your search interface. ... View more

Talvez algo assim: index=analise Task.TaskStatus="Concluído" Task.DbrfMaterial{}. SolutionCode="410 TROCA DO MOD/PLACA/PECA" State IN ("*") CustomerName IN ("*") ItemCode("*") | spath path=Task.DbrfMaterial{} output=DbrfMaterial | mvexpand DbrfMaterial | table TaskNo DbrfMaterial | spath input=DbrfMaterial path= | table TaskNo EngineeringCode ItemDescription ItemQty SolutionCode Como exatamente você gostaria que sua tablela fosse? ... View more

I've had this issue before with a custom app and tried recreating it from scratch to no avail. However, changing the locale in the URL (e.g. en-US to en-GB) somehow got the inputs page to load. Perhaps it will work for you. ... View more

Is there any reason why you aren't creating a token from the interface under Settings->Users and Authentication->Tokens, and then using it to call the API? That would be much more reliable than using a single session key. ... View more

This looks like it would work. If you're not quite sure and you want to make sure it is correct before the data goes into the index, then you could set up a sandbox index and use crcSalt to stop the logs from being registered as indexed already. In terms of billing, you would be paying for all logs, sandboxed or not, but it would avoid the annoyance of deleting wrongly-indexed data in your production indexes. E.g. [monitor://D:\Exchange Server\TransportRoles\Logs\*\ProtocolLog\SmtpReceive] whitelist=\.log$|\.LOG$ time_before_close = 0 sourcetype=MSExchange:2019:SmtpReceive queue=parsingQueue index=sandbox disabled=false crcSalt = "testing" (then remove or modify the crcSalt when the logs look good in the sandbox and are ready for production.) ... View more

Indeed I also cannot find a direct statement in the docs about this. I would assume that SOAR falls back to the community license, but I have never seen a SOAR license expire on a machine.  You could submit this question as feedback at the bottom of the docs page for the SOAR license, then they may add this information in a future version ... View more

Usually people safelist the SplunkForwarder service and the entire SplunkForwarder directory. You could safelist individual services and apps but you may end up spending lots of time playing whack-a-mole. You may be able to look through the community forums and Splunk Slack usergroup for your particular EDR solution to see if others have specific tips applying to that EDR.  ... View more

What makes you think it may be the wrong algorithm for your use case? ... View more

You could calculate the current hour of the alert execution, then adjust the threshold at the end. <mySearch> | bin _time span=1m | stats avg(msg.DurationMs) AS AvgDuration by _time, msg.Service | eval hour = strftime(now(),"%H") | where (AvgDuration > 1000 and hour >= 8 and hour < 17) or (AvgDuration > 500 AND (hour < 8 OR hour >= 17)) ... View more

Try the API: | rest "/servicesNS/-/-/saved/searches" splunk_server=* | regex search="index=\*" | table title search disabled author eai:acl.app ... View more

The targeted server/endpoint for integration with this app is the machine that you would like to run commands on. The server/endpoint itself does not need to be integrated into SOAR, but rather SOAR needs credentials/certificates/tickets to authenticate with the winRM service on the target server/endpoint. ... View more

This app is listed as "Developer Supported", which means you may have more success by directly contacting the developer to ask if they plan to add the retrieval of archive events to future releases. Email Support email: support@mimecast.com Contact Notes For technical support, visit https://community.mimecast.com/s/contactsupport ... View more

Not directly in the web UI, but you can set the number of page entries by changing the URL parameters. Go to the "Events" queue, then set the page size using the dropdown to any value other than the default. You will then see your URL look like: https://yoursoar.com/browse?page=1&per_page=25&filter=new_events&status=new You can then change per_page=25 to any number. For 100 entries, set per_page=100. You can do this with Playbooks, Events, and Cases. ... View more

Can you paste a copy of your original event in a code sample format? Perhaps one of the double-quotes is wrong. ... View more

Could you log in as the Splunk user on your indexer and then run btool for the stanzas relating the TLS-secured forwarding? /opt/splunk/bin/splunk btool inputs list SSL /opt/splunk/bin/splunk btool inputs list splunktcp-ssl /opt/splunk/bin/splunk btool server list sslConfig Make sure that the settings are set according to the instructions in the article. If they are the wrong values, then add --debug to the btool commands to find the file which is setting the command. If there are no problems there, then do you find specific complaints in the splunkd log of the forwarder? E.g. "Invalid certificate", or does the connection time out? Have you been able to forward logs, even _internal logs, before setting up TLS? ... View more

When you press the "New Token" button, then do you see the "New Token" menu which contains the fields: User, Audience, Expiration, Not Before, and then a field for "Token" which has the warning that the token will appear there only once upon creation? When you press "Create", then the "Token" field will contain the token itself, not the token ID. In the Tokens page, you will see the tokens listed, and the first column will be their token ID ... View more

It is possible to use props.conf settings on your indexer machines to pre-process the JSON into distinct events for each transaction, but I will assume that you instead have that one json object as a single event in Splunk. You can then use the following search: <Your search for finding the json event> ``` Chop off the first and last brackets ``` | rex field=_raw mode=sed "s/^{//" | rex field=_raw mode=sed "s/}$//" ``` Add a "SplitHere" keyword to target with a makemv command ``` | rex field=_raw mode=sed "s/},/},SPLITHERE/g" max_match=99 ``` Remove the Transaction1 etc. labels for each sub-object ``` | rex field=_raw mode=sed "s/\s*\"Transaction\d*\"\s:\s//g" max_match=99 ``` To avoid making _raw a multivalue lets eval it to the "a" field ``` | eval a = _raw ``` Split 'a' into multiple values and table it ``` | makemv a delim=",SPLITHERE" | mvexpand a | table a ``` Extract the key values for each json object ``` | spath input=a ``` Filter to desired fields and make it into final table with renaming and rounding ``` | table transaction pct2ResTime | rename transaction as "Transaction Name" | eval pct2ResTime = round(pct2ResTime) ... View more

At first glance I would suspect that the search filters for your roles are contradicting each other and filtering out all events. E.g. if you have the following roles with search filters: ROLE A - (index=index1 sourcetype=something) ROLE B - (index=index2 sourcetype=something) Then if you have role A and B, then Splunk will force you to search with "(index=index1 sourcetype=something) (index=index2 sourcetype=something)" which will retrieve 0 events because none exist in both index1 and index2 at the same time. Are you able to post your sanitized search filters to look for contradictory filters? ... View more