Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Azerty728
Azerty728
Path Finder
Member since:
02-11-2013
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 3 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-11-2013 |
Activity Feed
- Posted Re: Upgrade 5.2.2 to 5.3 - is the documentation wrong or is it me ? on Splunk Enterprise Security. 06-13-2019 11:35 PM
- Posted Re: Upgrade 5.2.2 to 5.3 - is the documentation wrong or is it me ? on Splunk Enterprise Security. 06-06-2019 07:15 AM
- Posted Re: How to add "open in search button" for notable events? on Splunk Enterprise Security. 06-05-2019 07:50 AM
- Posted Re: events with future timestamp on Getting Data In. 06-05-2019 07:02 AM
- Posted Upgrade 5.2.2 to 5.3 - is the documentation wrong or is it me ? on Splunk Enterprise Security. 06-05-2019 06:40 AM
- Tagged Upgrade 5.2.2 to 5.3 - is the documentation wrong or is it me ? on Splunk Enterprise Security. 06-05-2019 06:40 AM
- Tagged Upgrade 5.2.2 to 5.3 - is the documentation wrong or is it me ? on Splunk Enterprise Security. 06-05-2019 06:40 AM
- Tagged Upgrade 5.2.2 to 5.3 - is the documentation wrong or is it me ? on Splunk Enterprise Security. 06-05-2019 06:40 AM
- Tagged Upgrade 5.2.2 to 5.3 - is the documentation wrong or is it me ? on Splunk Enterprise Security. 06-05-2019 06:40 AM
- Posted Re: Splunk Enterprise Security: Adding exclusions to my Correlation Search for IPS? on Splunk Enterprise Security. 07-10-2018 07:42 AM
- Posted Re: Is the Rate limiting - 2000 logs per polling max, limitation built in the addon or is it a limitation within Microsoft Cloud? on All Apps and Add-ons. 03-05-2018 05:35 AM
- Posted Re: Microsoft Cloud services Addon stops collecting logs on All Apps and Add-ons. 12-29-2017 07:05 AM
- Posted Re: Microsoft Cloud services Addon stops collecting logs on All Apps and Add-ons. 12-29-2017 02:11 AM
- Posted Re: Microsoft Cloud services Addon stops collecting logs on All Apps and Add-ons. 11-29-2017 12:51 PM
- Posted Is the Rate limiting - 2000 logs per polling max, limitation built in the addon or is it a limitation within Microsoft Cloud? on All Apps and Add-ons. 11-28-2017 06:02 AM
- Tagged Is the Rate limiting - 2000 logs per polling max, limitation built in the addon or is it a limitation within Microsoft Cloud? on All Apps and Add-ons. 11-28-2017 06:02 AM
- Tagged Is the Rate limiting - 2000 logs per polling max, limitation built in the addon or is it a limitation within Microsoft Cloud? on All Apps and Add-ons. 11-28-2017 06:02 AM
- Posted Re: Microsoft Cloud services Addon stops collecting logs on All Apps and Add-ons. 11-23-2017 01:06 AM
- Posted Re: Microsoft Cloud services Addon stops collecting logs on All Apps and Add-ons. 11-16-2017 12:09 AM
- Posted Re: License required... ? on All Apps and Add-ons. 10-16-2017 06:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-13-2019
11:35 PM
Hi gjanders,
Thanks for your answer. Finally I was not the only one having an issue with this.
Unfortunately, I already have the correct stanza in my local server.conf file, configured with the name of my SH Cluster (shcluster_label parameter).
I will continue to investigate....
Kind regards.
... View more
06-06-2019
07:15 AM
Hi lkutch for your answer.
This server is historically a deployment server, since several years. We upgraded from different versions of ES through time.
On the shcluster directory, there is previously upgraded ES version (5.2.2).
So the problem still resides unsolved : when I try to upgrade 5.3 on this cluster master/deployer§deployment server, it does not "dynamically detect" my deployer function, i.e. I've got the following message during the "Post Install configuration" :
Configuring Splunk Enterprise Security on a Single Search Head Deployment
Splunk Enterprise Security is being configured on a single search head deployment. Technology add-ons can be installed and configured as a part of the post-install configuration.
And even after validating the following steps, there is still nothing in the etc/shcluster directory related to SplunkEnterpriseSecuritySuite ES directory.
I think the detection process is blocked by something but I don't know what...
I've got another brand new platfom, on which installing 7.2.6 and ES 5.3 directly was butter smooth, it detected that the server was a deployer, and all was correctly deployed on SHC.
Regards.
... View more
06-05-2019
07:50 AM
Hello,
You can also create a Workflow Action, which can open the search. The Workflow action will appear at the end of the notable line in Incident Review, under "Actions" column.
My 2 cents
... View more
06-05-2019
07:02 AM
Hi,
You should try
TIME_FORMAT = %b %e %H:%M:%S
instead of
TIME_FORMAT = %b %d %H:%M:%S
It seems you have an additional space between %b and %d too, which probably does not help...
... View more
06-05-2019
06:40 AM
Hello,
I'm using Splunk 7.2.6 and ES 5.2.2 (on a SHC) and I want to upgrade ES to 5.3 on this SHC environment.
According to the install documentation, I did the following :
- install ES 5.2.2 on Master Deployment server (ES was never installed before on the deployer, only on SHC members)
- restart, blabla, then "splunk apply shcluster-bundle"
As long as I already had ES 5.2.2 on SHC members, nothing was changed.
According to the UPGRADE documentation now, I did the following :
- install ES 5.3 on Deployer (via the GUI, as explained)
- restart blabla, splunk apply shcluster-bundle.
And 5.3 was NOT deployed on my SHC members, just as I expected.
In fact, as far as I understand Splunk deployment, installing something on the deployer via GUI will install the app (here ES) in etc/apps.
For any app to be deployed by deployer, it has to be present in etc/shcluster/apps.
So here is my point : how is it possible for ES to be deployed anywhere if it's only installed in etc/apps ?
Did I miss anything, or is it something missing in the documentation ?
Link to th docs :
Install : https://docs.splunk.com/Documentation/ES/5.3.0/Install/InstallEnterpriseSecuritySHC
Upgrade :
https://docs.splunk.com/Documentation/ES/5.3.0/Install/UpgradeEnterpriseSecuritySHC
Thanks for the help.
Regards.
... View more
07-10-2018
07:42 AM
Since 7.1.1, when a field is multivalue, after the rename (included in the drop_dm_object_name macro) it's no longer a MV field.
Splunk changed something in the rename commande, and it has broken the multivalue capability.
Sad !
... View more
03-05-2018
05:35 AM
Hi all,
@hkust,
15s is very small. You can't keep reducing this timer, because addon still needs time to get those messages.
Maybe you don't have sufficient bandwidth to get enough messages every 15s ?
And to answer @mwoods2, the best way to ensure you get all messages is to get an alert every time you have Index=1999 in order to reduce polling interval. But this is not a miracle solution, just a temporary workaround. Quid when there's a message burst ?
Regards.
... View more
12-29-2017
07:05 AM
Good news, it's working !
The patch seems OK : it replaces the PublisherID with our TenantID instead of zeroes, and it works !! I've got plenty of logs now !
I encourage everyone to file a case to Splunk support to ask for the patch, or wait till Splunk releases it officially.
Best regards !
... View more
12-29-2017
02:11 AM
Hi there,
No offical release date. Stay tuned for that. BUT :
I received the addon's patch from Splunk support in order to try (this hotfix is tagged as working by other client, but I didn't get the time to check it on my own).
I encourage you to file a case to Splunk and ask for it if you're impatient enough :D.
I'll update this thread as soon as I've tested it.
Have a nice new year's eve, splunkers 🙂
,Hi there,
No official release date, but you can file a case to Splunk and ask for the hotfix. I received it but didn't have time to test it yet.
I'll update here ASAP if it's working (or not).
Have a nice new year's eve.
Regards
... View more
11-29-2017
12:51 PM
They didn't give any info.
I asked them, I filed a case last week about this problem.
I hope we won't be waiting too long.
Cheers
... View more
11-28-2017
06:02 AM
Hello there,
This post to ask a question, but mostly to share experience on this addon.
We discovered that the addon limits the number of logs obtained on every connection it makes to the Microsoft Cloud.
Every time you pull, you will only get 2000 logs. So if you pull every hour, you will get 2000 logs/hour. If you pull every 30 seconds, you will get 240 000 logs/hour (max).
So depending on your infrastructure, please note this behavior. Every message polled is assigned an Index value, going from 0 to 1999. So you can use this field to monitor whether you lose logs or not...Search for "Index=1999" and if it matches then you may have lost logs... So reducing the polling time in the addon's "Inputs" configuration may help to get all your logs.
And now the question: is this a limitation built in the addon, or is it a limitation within Microsoft Cloud ?
There is nothing in the GUI of the addon to modify this value.
Is someone has the info, please share.
Regards
... View more
11-23-2017
01:06 AM
It seems a new addon version is on the run on Splunk's side, where it will be possible to change the PublisherID.
Wait & see, stay tuned !
... View more
11-16-2017
12:09 AM
Microsoft told me that the PublisherID is a number (preferably the tenant ID). For the PublisherID full of 0, they said that the quota is shared among the same PublisherID connections, and limited to 60k message/minute.
Problem is that I couldn't change this PublisherID in the Splunk Addon to use my tenantID.
The only location I found this suite of zeros among all the addon files was "_serialization.py".
Unfortunately, changing this value to the tenantID and restarting splunk didn't solve the problem.
So if any has another idea...
Microsoft related page containing info about PublisherID :
https://msdn.microsoft.com/en-us/office-365/office-365-management-activity-api-reference#api-throttling
... View more
10-16-2017
06:15 AM
Yeah but you con't install this addon on a UF, it is still dedicated to the HF.
... View more
10-13-2017
05:42 AM
Maybe you can add the machine indexing the data. You should have one at least ?
And then put your HFW as a slave of this machine.
... View more
10-13-2017
01:07 AM
Thanks, I no longer have the message !
And thanks for your very quick answer too.
Best regards.
... View more
10-12-2017
08:27 AM
Hello there,
I'm trying to install this addon on a distributed environment. I installed on the Heavy Forwarder as specified, and on the search heads.
I deployed with deployment server, and here is the log I get in the ta_ms_o365_message_trace.log on the HF :
HTTPError : HTTP 402 Payment Required -- Requires license feature='KVStore'
My question is : is there any workaround or did I something wrong to install ?
FYI, I installed on a standalone Splunk server and didn't have any issue.
My HF is version 6.5.2.
Best regards, and hope someone will help 🙂
... View more
08-12-2015
08:52 AM
I am answering my own question :
I created my workflow_actions.conf where I put my workflow actions, in my app directory.
Then in metadata/default.meta, I added stanzas of my workflow actions like below, and an export key to the apps where I want my workflow actions appear:
[workflow_actions/View_Notable]
export = SA-ThreatIntelligence
[workflow_actions/Email_generation]
export = SplunkEnterpriseSecurity
So my workflow actions appear where I want to ! (in SA-ThreatIntelligence and Enterprise Security).
That's all.
... View more
07-16-2015
05:34 AM
I'm on distributed environment with deployment server.
I created an application, outside ES but based on ES result search.
In order to simplify the interaction between the two apps (Es and my app), I added a Workflow action in ES, that points to my app (GET method).
Now I want to package my app. But my workflow action is still (created) in ES.
If I want to incorporate my workflow_actions.conf in my own app directory, how can I make it deploy in ES too ? Because right now, if I deploy my app, it only deploys files on my search heads but not this wworkflow_actions.conf in ES directory.
I hope this is clear enough to be understood.
Regards.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
