We have Splunk cloud and SOAR cloud in our environment. We want to integrate SOAR audit log in to Splunk cloud. We have tried with "Splunk App for SOAR" app. App have inbuilt feature of index creation so we did it from that inbuit feature.  We can't see any other configuration options. So how this logs can integrate in Splunk. ... View more

During the integration of Sailpoint initially got error for the certificate as below. https://community.splunk.com/t5/All-Apps-and-Add-ons/Certificate-error-with-SailPoint-Adaptive-Response-app/m-p/520271#M63493   After adding CA signed certificate in aob.py3 directory getting below error. 2022-03-21 23:07:22,432 ERROR pid=15767 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_sailpoint/bin/splunk_ta_sailpoint/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/Splunk_TA_sailpoint/bin/sailpoint_identityiq_auditevents.py", line 72, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/Splunk_TA_sailpoint/bin/input_module_sailpoint_identityiq_auditevents.py", line 143, in collect_events headers = build_header(helper, identityiq_url, client_id, client_secret) File "/opt/splunk/etc/apps/Splunk_TA_sailpoint/bin/input_module_sailpoint_identityiq_auditevents.py", line 109, in build_header return build_oauth2_header(helper, identityiq_url, client_id, client_secret) File "/opt/splunk/etc/apps/Splunk_TA_sailpoint/bin/input_module_sailpoint_identityiq_auditevents.py", line 94, in build_oauth2_header access_token = json.loads(token_body)['access_token'] File "/opt/splunk/lib/python3.7/json/__init__.py", line 348, in loads return _default_decoder.decode(s) File "/opt/splunk/lib/python3.7/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/opt/splunk/lib/python3.7/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) ... View more

https://apps.splunk.com/app/4770 Servicenow security operations event ingestion addon for splunkes And https://apps.splunk.com/app/3921 Servicenow security operations addon Both are supporting on-demand based incident creation in servicenow so what is the actual difference here. Anyone have any idea? Event ingestion add on required license addon from servicenow that I know. It is the only difference or something else also? ... View more

After installing microsoft windows add on I could not see applicable tags for network resolution data model with respect to DNS logs. Why I could not see any tag? Any thoughts! ... View more

I have total counts of unique IP hits. how can I create dynamic baseline for the hit counts with respect to IP addresses. Tried some average and standard deviation formulas but not getting expected output with search processing power optimization ... View more

I have result in one field from the lookup and also result in second field(multivalue results) from lookup. Accessed group = 1 Allowed group=1 =2 So if any value match with allowed group then it should not trigger. ... View more

I have below search criteria so let me know best way for this. base search (which have output in table format) [table sourcetype def ghi] sourcetype= 1 check with static lookup and store respective result in "ghi" field sourcetype= 2 check with static lookup and store respective result in "ghi" field ... View more

I have summary indexes but not able to identify search criteria for that. Where I can check? Sourcetype is stash ... View more

Any solution for below error. log_level=ERROR, pid=7401, tid=MainThread, file=checkpoint_opseclea.py, func_name=main, code_line_no=178 | Encounter exception=Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/checkpoint_opseclea.py", line 175, in main run() File "/opt/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/checkpoint_opseclea.py", line 134, in run loader.run(jobs) File "/opt/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/splunk_ta_checkpoint_opseclea/splunktaucclib/data_collection/ta_data_loader.py", line 64, in run job.stop() File "/opt/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/splunk_ta_checkpoint_opseclea/splunktaucclib/data_collection/ta_data_collector.py", line 91, in stop self._client.stop() AttributeError: 'TADataCollector' object has no attribute '_client' ... View more