Good day Is it possible to configure MS AD objects to use kv store for the lookup file instead of CSV ? We have a very large AD environment and lookups take up more space and time to sync with the search bundles. Regards Brandon ... View more

Howdy We have installed and configured the add-on and data is being retrieved. However we notice that the timestamp on the alert events is wrong - it seems to be exactly 2 hours behind. We check the SQL eventtime and it is correct there but the script seems to to be incorrectly interpreting the timestamp? The format in the database is YYYY-mm-dd HH:MM:SS.3N but Splunk shows YYYY-mm-ddTHH:MM:SS.XXXXXX Thanks B ... View more

Hi The action field result do not evaluate properly as the field alias (EVAL-action) in the props.conf doesn't have all the correct values for the event.DetectName field. For example I am getting "Activity Prevented", which is not specified in the eval function. I would recommend rather using a lookup table (vendor action list) like some of the other vendors do. http://docs.splunk.com/Documentation/AddOns/released/McAfeeEPO/ConfigureLookups Regards Brandon ... View more

Hi I am trying to configure the Splunk DB Connect Add-on to use the JDBC driver to connect to a HP NonStop SQL/MX database. I have the driver (t4sqlmx.jar) in the $SPLUNK_HOME$/etc/apps/splunk_app_db_connect/bin/lib/ directory and my db_connection_types.conf is below: [t4sqlmx] displayName = HP NonStop SQL serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcUrlFormat = jdbc:t4sqlmx://<host>:<port>/: jdbcDriverClass = com.tandem.t4jdbc.SQLMXDriver testQuery = SELECT 1 port = 18650 Splunk DB Connect however does not seem to detect the driver. I got the driverclass from the documentation: http://h20565.www2.hpe.com/hpsc/doc/public/display?sp4ts.oid=4201303&docId=emr_na-c03465685&docLocale=en_US Not sure if anyone has had experience with HP Nonstop DBs? Thanks B ... View more

Good day We are only seeing user logoff events in the Authentication dashboard - there are no logons or failed login attempts etc. Should these be under type=event ? We currently use Active Directory for authentication. regards B ... View more

Hi I've installed the Splunk Add-on for MySQL as per the documentation and it is not working. I have tested DB Connect to and from the server and it is working. I checked the splunkd.log and I get the following python errors: 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" Traceback (most recent call last): 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" File "/mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py", line 232, in <module> 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" main() 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" File "/mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py", line 226, in main 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" run() 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" File "/mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py", line 154, in run 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" meta, stanzas, global_settings = mysql_conf.get_configs() 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" File "/mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql_config.py", line 39, in get_configs 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" self._update_stanza_configs(default_configs) 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" File "/mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql_config.py", line 73, in _update_stanza_configs 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" defaults[c.mysql_data_collection_settings]) 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" File "/mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql_common.py", line 24, in get_mysql_variables 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" p = subprocess.Popen(mysql, stdout=subprocess.PIPE, stderr=subprocess.PIPE) 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" File "/mnt/splunkstore/splunk/lib/python2.7/subprocess.py", line 710, in __init__ 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" errread, errwrite) 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" File "/mnt/splunkstore/splunk/lib/python2.7/subprocess.py", line 1335, in _execute_child 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" raise child_exception 11-11-2015 10:47:11.145 +0200 ERROR ExecProcessor - message from "python /mnt/splunkstore/splunk/etc/apps/Splunk_TA_mysql/bin/mysql.py" OSError: [Errno 2] No such file or directory Thanks Brandon ... View more

Hi Just a note that your field extraction below has global permission and overwrites other "user" field name extraction. You should make it app permission level only. default : EVAL-user user md5(clientip."_".http_user_agent) ... View more

Hi Is it possible to get search head pooling to work on *nix with a remote fs (shared storage) other than NFS - perhaps SMB or sshfs? If anyone has been able to get this working, please let me know regards Brandon ... View more