Hello, I've recently upgrade from Splunk 7.0 to Splunk 9.0. One of the things that ended up breaking is the Splunk Add-on for Tenable (5.1.4). I knew it was going to stop working due to compatibility issues and that's fine since we really needed to upgrade Splunk. Is there any other way for our Splunk environment to receive Nessus data? We currently have Nessus Professional Version 10 and it does not seem to work with the Tenable Add-on for Splunk.  Thanks, Grant ... View more

Hi, I'm not exactly sure what is the best way to approach this issue. I have a list of external IP address along with descriptive names for each of those IP addresses. I want to make it so that all Splunk Enterprise Security dashboards show that descriptive name every time one of those known external IP addresses appear. What is the best way to associate each name to each of my known external IP addresses? Example: My external IP = 54.123.123.123 My descriptive name = MyExternalMailServer Thanks, Grant L ... View more

Hello, I'm currently running the Splunk App for AWS and am receiving the data without a problem into its own index in our Splunk environment. I've configured Splunk ES CIM data models to look at our custom AWS index. My issue is that we have a correlation search (Short-lived Account Detected) turned on that is not working with our AWS logs properly. This correlation search came out of the box with Splunk Enterprise Security and works with our Windows Logs without an issue. The problem is that this correlation search is supposed to show the account that was created and deleted within a short amount of time. But when it comes to our AWS logs, the correlation search generates a notable event that displays the wrong account name. It shows the account that performed the creation and deletion of the short-lived account and we do not want that. (Example shown in image below.) I've went into the back-end (Linux CLI) to create a props.conf with a field-alias statement in the Splunk_TA_aws local configuration on our Splunk ES server, but the field alias didn't map the "requestParameters.userName" field to the "user" field like I thought it would. I thought that if I had mapped the interesting field to the field that the data model looked for, then it would show up in the notable event. This is the props.conf field alias that I created in the Splunk_TA_aws local configuration on our Splunk ES server: [aws:cloudtrail] FIELDALIAS-requestParameters.userName-for-aws-cloudtrail = requestParameters.userName AS user I'm I going about solving this issue the right way? If not, is there a better way to fix this? Thanks, Grant ... View more

Hello, I keep hearing flip-flop answers from people saying that if I upgrade Splunk Enterprise 7.0, then I won't be able to receive logs from Windows 2003 servers with a Splunk universal forwarder on it. Is this true or not? ... View more

I have Splunk currently running on version 6.6.3. I am upgrading Splunk Core from 6.6.3 to version 7.0. However, I have two questions that I can hopefully get answers to: Is the "Cisco eStreamer eNcore Add-on for Splunk" compatible with Splunk Core 7.0? Is the "Cisco Firepower eNcore App for Splunk" compatible with Splunk Core 7.0? On Splunkbase, the app and the add-on do not list Splunk version 7.0 as a compatible version. Is it safe to assume that the app and add-on will work on Splunk version 7.0? ... View more