@FrankVl wrote: IPv6 is a completely different addressing scheme than IPv4. You can't translate IPv6 addresses to IPv4 addresses. In this instance im 99.999% sure he's talking about IPv4 in IPv6 and converting it back to IPv4. So Yes. But no. We're dealing with this right now (we're are borg, you will be assimilated). IPv6 is not IPv4 but IPv6 can encapsulate (thats the word i chose, deal with it 😄 ) IPv4. Salesforce does this. You get something like ... 0000:0000:0000:0000:0000:ffff:abcd:ef01 in this example ab is first octet, cd is second, ef is third, and 01 is fourth. you have a couple of options for dealing with this but all of them start with an extract of the octets  and then involve an EVAL- that puts them back together. The only difference is that instead of doing a tonumber() repeatedly, you could add the option of using a lookup table instead which may save some processing power for LISPY (or not given all the extra steps; i have no idea). The easiest option after EXTRACTing out the octets is... EVAL-ipaddr = tonumber(hex_value, oct1)+"."+tonumber(hex_value, oct2)+"."+tonumber(hex_value, oct3)+"."tonumber(hex_value, oct4) If someone has a better way, i'd love to hear it. If not please accept this answer so i get coolness points.  ... View more

im in!   ... View more

Look into "CLONE_SOURCETYPE"? or maybe this here. sorry for the hit n run... https://community.splunk.com/t5/Getting-Data-In/How-can-I-use-CLONE-SOURCETYPE-to-send-a-cloned-modified-event/m-p/317487 ... View more

So this is a very old question but i just wanted to give the solution for any version post 7.1+.  Normally the mgmt port being off for a Universal Forwarder is a no-brainer, but sometimes it might actually be nice to see how the UF is handling some sed/regex/etc by using btool directly. you can go look at configs all day but if somethings being clobbered.... if you cannot login, you never set a password (Looking at you, Windows 'msiexec.exe /quiet' people...). to do this, or to reset your password for a universal forwarder, delete the etc/passwd in the  ***splunk*** directory (now looking at you, Linux people - dont do that mistake... ), and place a user-seed.conf in system local. Details can be found here: https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/User-seedconf.  Oh, and your management port might be disabled in server.conf; check that too. and web.conf if the port was assigned to something else.  was rummaging around google for something completely different but, stumbled across this and had to update it....   ... View more

So its funny, Here we are in 2020 and people are still using Sharepoint 2016 instead of o365 flavor. I'm not sure why Splunk deemed the '16 version no longer relevant. At one point there as a TA_sharepoint somewhere (either Splunkbase or Github). Github has an app for Sharepoint but thats it. Their history even notates that they removed everything from the app to split it into an TA /app solution. I could go back in the past to recover it but at least right now I feel like the answer for the data I need is probably going to be much simpler ( not sure yet, just getting to the ingest phase...)  Any luck with this? i see your question is from September. ... View more

So it appears you actually can, but the trick is here: https://docs.splunk.com/Documentation/Splunk/8.0.7/AddAWSConfigRulesSingle/ConfigureHECKinesis#Configure_timestamp_extraction Last check, AWS does not allow you to work with this switch (for Kinesis Firehose situations), but you can test it out with your own HEC:  /services/collector/event?auto_extract_timestamp=true <etc>  It should be noted that this enters at the merging pipeline, and not right into the typing. https://www.aplura.com/assets/pdf/hec_pipelines.pdf   ... View more

Try this fix: | inputlookup SSE-default-data-inventory-products.csv | outputlookup data_inventory_products_lookup it wipes any manual stuff you have already done, but the next time you try it actually works. Its worth a try. ... View more

the ta name listed there in the path... is not right. you have to rename your app to the "function1_wls_admin_win_ta" instead of whatever it is. sadly i cant say this app was fully vetted. not the windows side at least. PS. you might want to add the path to java in your setwlstenv.cmd .. path=%path%;c:\java\stuff ... View more

While it may get rid of the problem showing up in the the messages, it still doesn't address whatever this issue is. I would have figured that someone would have a much better answer by now - especially since its related to Enterprise Security :-(. ... View more

I too am having this issue with my SplunkES instance. Of course, it is highly underpowered but still suffering this issue after upgrading to 7.1.1 Other instances are not having this issue. All are Azure VMs ... View more

i just want to know if there is something i missed in configuring.. or that i configured wrong which is completely a possibility ... View more

that's a possibility, but the thing is this is how the dashboard came packaged; i I guess i should have said something more along the lines of 'it was broken out of the box and removing index references fixed it' ... View more