I have added a threat feed from abuse.ch after adding it shows me the error "threat list could not be written to disk" on Audit threat intelligence page. i have checked the error and says: tanza="Abuse" status="threat list could not be written to disk" Traceback (most recent call last): File "\Splunk\etc\apps\SA-ThreatIntelligence\bin\threatlist.py", line 366, in download_csv shutil.move(temp_checkpoint_filehandle.name, args['target_filename']) File "\Splunk\Python-2.7\Lib\shutil.py", line 316, in move copy2(src, real_dst) File "\Splunk\Python-2.7\Lib\shutil.py", line 144, in copy2 copyfile(src, dst) File "\Splunk\Python-2.7\Lib\shutil.py", line 96, in copyfile with open(src, 'rb') as fsrc: IOError: [Errno 13] Permission denied: u:\splunk\modinputs\threatlist\Abuse.txt But it says downloaded: tid=MainThread file=threatlist.py:download_csv:360 | stanza="Abuse" retries_remaining="3" status="threat list downloaded" file="\Splunk\var\lib\splunk\modinputs\threatlist\Abuse.txt" bytes="5746" url="https://feodotracker.abuse.ch/downloads/ip.txt" Someone please help me with the steps to be followed. ... View more

This is a totally weird situation. I have few correlation searches for which notables are suppose to be generated for SOC monitoring. On security posture, i have SOC dashboard, whoch displays the searches | es_notable_events |search timeDiff_type=current | chart count over name by status here it shows total notables created as new and assigned. Since sunday this is giving me weird results. It shows some random numbers on the dashboard but when i drill down it gives, "Search did not return any events." when i run index=notables, i can see all the notables are getting generated however same is not getting in the lookup file "es_notable_events" can someone help with the troubleshooting steps? also, i could see the number displayed over security posture and total count i get when drill down are totally different. Request some expert advise. ... View more

Since morning i am observing my notables are not getting created. I can see the Notable names in Security posture but once i click on that it doesnt show any results. when i copy paste the same search on searching and run manually it gives proper results. What all are the checklist i need to check for this issue? ... View more

till few afters before all my notables were working properly. I made changes in XML file of default.xml on navigation menus using user interface on splunk. After that i restarted the splunk but was unable to get back the splunk and got the error: Read Timeout after few hours without doing anything as such i could get back on SPLUNK But i stopped getting any notables created. Now my notables are 0 and earlier it used to be more than 95notables per hour Please help me out with the troublehsooting ... View more

I have recently modified my navigation menu XML through splunk user interface. Now when i refresh the splunk instance i am unable to connect to the SPLUNK. it shows me following error: Read Timeout i have also reverted the chnages but it is not getting reflected. major things i have changed is color from color="#474444" to color="#0072C6" i showed me that error. again i changed it back but seems lot of my dashboards are now distured. How to restore the changed? and how to troubleshoot this ... View more