About wild0104

wild0104 · ‎08-07-2017

I upgraded The Splunk_TA_paloalto to v3.8.1 and the SplunkforPaloAltoNetworks App to v5.4.1 and this resolved my errors.

wild0104 · ‎06-26-2017

We're running Splunk 6.6.1 doing both search head and indexer clustering, I recently upgraded the Palo Alto Networks App to v5.4.0 and the Palo Alto Networks Add-on for Splunk to v3.8.0. After doing this and deploying it out to the search heads and indexers they are getting the following errors: Search Heads: Search peer sh-server-1 has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_PaloAlto": Introspecting scheme=autofocus_export: script running failed (exited with code 1). Indexers: Search peer idx-server-1 has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_PaloAlto": Unable to locate suitable script for introspection. After reading about the Autofocus feature it doesn't appear to be something that we need or would use, but seems to be generating the errors above. I'd like to just disable it so it stops throwing the errors, but can't seem to find any documentation other than how to configure/set it up on the Palo Alto Networks documentation. Any assistance would be greatly appreciated. Thanks, Jacob

wild0104 · ‎07-19-2016

Couple questions: 1) Are you using LDAP for authentication? 2) Are you using a deployment server to manage your distributed environment? We are using both of the above so I just added an line in the roleMap stanza of the authentication.conf being pushed to all our search heads in the cluster and mapped the winfra-admin group to an existing AD group used in our Splunk deployment. I think you could also do this via the deployer for your sh cluster by creating an "app" in the %SPLUNK INSTALL%\etc\shcluster\apps that would push the authentication.conf with your roleMap out to the members of your sh cluster. Hope that helps!

wild0104 · ‎07-19-2016

Could you setup Splunk to generate an e-mail off the alert and then have that e-mail open the defect in Rally? I found this on GitHub that opens defects or user stories in Rally (depending on whether 'defect' is at the start of the email subject) but there may be other ways to accomplish this in Rally today as it looks like it's 4 years old. That'd be the route I'd take to try and accomplish what I think you're looking for. Hope this helps. Jacob

wild0104 · ‎05-12-2016

I have seen one issue which I could use some help or guidance on how to fix, occasionally I get where all the dashboards show "No results found", the last time I think I resolved it by rebooting all the indexers and search heads, but that's a pain. I tried rebuilding the data model for the app but that didn't resolve it, any other suggestions? Jacob

wild0104 · ‎04-28-2016

No, but I usually wait for the version I'm on to be supported before trying to install Apps or Add-ons.

wild0104 · ‎04-26-2016

Is there any ETA or plans to add support for Splunk Enterprise 6.3 or 6.4 to the Cisco Security Suite App? Thanks. Jacob

Posts	7
Solutions	0
Karma Given	0
Karma Received	5
Member Since	‎06-03-2014

Online Status	Offline
Date Last Visited	‎09-15-2021 09:34 AM

Disable Autofocus feature in Splunk App and TA

Cisco Security Suite: Are there any plans to add s...

Re: Disable Autofocus feature in Splunk App and TA

Disable Autofocus feature in Splunk App and TA

Re: Splunk App for Windows Infrastructure: How to ...

Re: Is there a way to open a defect in Rally (Agil...

Re: Cisco Security Suite: Are there any plans to a...

Re: Cisco Security Suite: Are there any plans to a...

Cisco Security Suite: Are there any plans to add s...