Question I work where we need to query mulitiple domains/IPs weekly to ensure none of our host
have communicated with these Domains/IPs. Is the getwatchlist App the correct path to choose to meet this objective?
Well, I am a little biased, but I would think so. Getwatchlist would be a good candidate if:
HTH,
Dave
Get this error " The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."
We were able to use the getwatchlist and the domains we want to query shows up, but how do we get that list of domains to be query agains our feeds that are feed into splunk ?
Will
Well, I am a little biased, but I would think so. Getwatchlist would be a good candidate if:
HTH,
Dave
Will,
It sounds like there is something else going on with your Splunk instance. You should check your logs or look at the SoS app to diagnose.
Here are some good blog posts on using getwatchlist against your data:
and
http://blogs.splunk.com/2011/09/08/anonymous-proxies/
Both of the posts contain examples of how you can use your downloaded watchlist against your events.
Thanks,
Dave
Get this error " The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."
We were able to use the getwatchlist and the domains we want to query shows up, but how do we get that list of domains to be query agains our feeds that are feed into splunk ?
Will