Would someone be able to help me understand how do to this?  I would like to modify the built in dashboard in the InfoSec APP to exclude a specific source IP address.  The default search the dashboard uses is below.   | tstats summariesonly=true allow_old_summaries=true count from datamodel=Intrusion_Detection.IDS_Attacks where * IDS_Attacks.severity="*" by IDS_Attacks.signature, IDS_Attacks.severity | rename "IDS_Attacks.*" as "*" | sort severity   Currently, that dashboard visual is full of events from my vulnerability scanner running scans.  ... View more

Hello Everyone, I'm hoping I can get some help on this.  We have the InfoSec app on our Splunk single-server deployment.  On the Network Anomalies page, I'm getting the warning "Eventtype 'wg_traffic_allow' does not exist or is disabled." Here is the search the dashboard is attempting to run.   `infosec-indexes` tag=network tag=communicate | streamstats current=f last(_time) as next_time by dest | eval gap = next_time - _time | stats count, avg(gap) as avg_gap, var(gap) as var_gap by dest src | search avg_gap<50 count>500 | stats dc(src)   Based on a google search and looking through the results, I was going to check that the eventtype was shared globally.  That's when I saw that the eventtype is actually defined as  'wg_traffic_allowed' with an 'ed' at the end.  So now my question is where is it even trying to pull that eventtype from?  It's not in the search.  It seems to be searching for tags not a specific eventtype. ... View more

Roughly once a week, I'm getting the following errors on my single instance Splunk deployment.   KV Store changed status to failed. KVStore process terminated.. 12/3/2020, 11:53:25 AM KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log for details. 12/3/2020, 11:53:25 AM   Now, I can fix the issue, by stopping Splunk, renaming the mongod folder and restarting Splunk but I want to know why I'm getting the errors and how to prevent them in the first place.  Any help or assistance would be greatly appreciated. ... View more

Hello Everyone, Does anyone know the best way to go about getting logs from our Acronis Backups solution to send it's logs to Splunk to get them ingested?  Also, any apps/addons that would be able to do the field extractions? ... View more

Hello Everyone,   I'm hoping to get some assistance.  My company using WatchGuard Firebox firewalls.  I'm working to get the data correcting ingested into Splunk and get all the fields extracted (HIGHLY prefer a CIM complaint format) but the only WatchGuard App and TA Addon I've found are outdated, poorly written (I've been told) and are not CIM compliant.  Is there an easy way to pull the information from the WatchGuard Log Catalog (https://www.watchguard.com/help/docs/fireware/12/en-US/log_catalog/Log-Catalog_v12_5.pdf) and put it into Splunk to properly ingest and label the data coming in from WatchGuard logs?       Thanks for any and all assistance with this! ... View more