About km1986

gabmsmith · ‎03-13-2023

My team was able to get this to work through the backend, too. Another thing to add here is that I kept getting this error when my SQL query started with "EXEC." When I asked the user for a query that started with "SELECT" because most of our other queries start with that, I stopped getting the error and it worked. I do not know enough about SQL to speak to the significance of this difference, but this is the behavior we are seeing. Splunk seems to take EXEC on the backend but not in the UI, and SELECT in the UI works.

km1986 · ‎12-26-2022

Hi All, How to get user details associated with 'aadUserId' field in logs from 'Microsoft Graph Security API Add-On for Splunk'. Does https://splunkbase.splunk.com/app/3757have to be installed to get the user name/user email ID?

CJHindmarsh · ‎11-23-2021

I was at the time utilizing the Splunk add on for Windows. It came with some predefined sourcetypes for Win Event logs.

km1986 · ‎11-23-2021

The inputs.conf had the stanza pointing to the wrong directory, also sourcetype name was missing after the upgrade. Had to connect the path and add the sourcetype name to fix

hoaxm3 · ‎09-20-2021

ThreatConnect just requires two indexes to be created. If you reference the indexes.conf file in the user guide (under installation) you would see the indexes 'tc_app_logs' and 'tc_event_data'. Create those indexes and see if that resolves the issue.

km1986 · ‎07-16-2021

@lukasmecir : Can you please update if you were able to determine a fix for this? I'm seeing the same issue. Thanks.

km1986 · ‎07-14-2021

Hi All, I have come across quite a few old posts around subnet configuration in Hurricane Labs App for Shodan (https://splunkbase.splunk.com/app/1767/) and questions around IP subnet configuration in 'Configure Subnets'. Can someone who has already set this up help with the below questions: 1. Is CIDR supported in 'configure subnets' 2. I have a list of around 100 subnets in CIDR notation, how do I go about configuring the same in 'Configure Subnets' (I tried pasting the complete list but I'm not sure that is working). Does the list have to be a separated by Commas? Appreciate any support/guidance anyone can provide.

Maciej · ‎03-30-2021

OK, I found atp_disable_ssl_certificate_validation setting in symantec_setup.conf file and used it as workaround, but I thing problem validating certificate issued by corporate trusted CA is still an issue. although corporate CA is trusted in system ca-bundle

richgalloway · ‎11-19-2020

Yes, it is possible. Set up the new token the same way you set up the old one.

richgalloway · ‎10-30-2020

If you're not using hybrid search then you don't need to upgrade your on-prem SH. If you are using hybrid search then contact Splunk Cloud support for a definitive answer. You should upgrade the SH anyway, however, since 7.0.5 is not supported.

km1986 · ‎10-23-2020

It is a temporary google drive link. If it benefits others, the engineer also mentioned that for older releases which are not supported, a splunk support ticket is necessary.

richgalloway · ‎10-01-2020

In general, it's a good idea for all Splunk components to use the same version of a TA/app.

gcusello · ‎09-24-2020

Hi @km1986, Good for you. Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉

km1986 · ‎09-23-2019

I saw same issue today. eNcore Version 3.5.8 ; FMC version 6.2.3.14 I realized that the hostname provided to generate the certificate in FMC was not the same as that of the splunk server on which the eNcore app is being installed. I re-generated the certificate with the same hostname as the Splunk server and the issue resolved.

Posts	23
Solutions	1
Karma Given	7
Karma Received	5
Member Since	‎09-23-2019

Online Status	Offline
Date Last Visited	‎04-01-2024 01:49 PM

How to get user details associated with 'aadUserId...

Cisco eStreamer encore 8.1.2 Data Ingestion Issue

Threat Connect logs going into lastchanceindex

Question on subnet configuration in Hurricane Labs...

Question on HEC configuration

Compatibility between search head in splunkcloud a...

Download link for Splunk 6.6.0

Splunk upgrade on Heavy Forwarder from v6.4.0 to v...

Using props.conf and transforms.conf to exclude 'U...

Error message when trying to configure the EDR ser...

Re: Splunk DBConnect 3.1.1 Build 34 There was an e...

How to get user details associated with 'aadUserId...

Re: Unable to Collect SMBServer/Audit logs

Re: Cisco eStreamer encore 8.1.2 Data Ingestion Is...

Re: Threat Connect logs going into lastchanceindex

Re: DataParserVerbose - Accepted time format has c...

Question on subnet configuration in Hurricane Labs...

Re: Error message when trying to configure the EDR...

Re: Question on HEC configuration

Re: Compatibility between search head in splunkclo...

Re: Download link for Splunk 6.6.0

Re: Splunk upgrade on Heavy Forwarder from v6.4.0 ...

Re: Using props.conf and transforms.conf to exclud...

Re: Handshake occurs but doesn't send data