have you solved the issue? ... View more

Can you increment the checkpoint number by one before saving it using the helper functions in the add-on builder? This should prevent it from getting the last event multiple times when there are no new events after the last checkpoint. ... View more

OK. I added an idea https://ideas.splunk.com/ideas/EID-I-2471 Feel free to upvote and/or comment ... View more

1. This is a very old thread. For better visibility you should rather start a new thread with a verbose description of your problem. 2. What does "doesn't work" mean? And did you do _any_ configuration on Splunk's side or do you just expect Splunk to work out of the blue? 3. As a side note - receiving syslog directly on Splunk component is not the recommended way. The recommended architecture is to use an external syslog daemon and either write to files from which you'll pick up the events with UF or send to HEC input. ... View more

Hello Splunkers! 🎉 You can now easily install Splunk Enterprise and the Universal Forwarder using this handy script. It supports all available versions and can be installed on any Linux distribution. For detailed installation steps, please visit : https://github.com/PraxisForge/Install_Splunk Upgrade universal forwarder version (nix) #Splunk Enterprise(nix) #Universal Forwarder(nix) #Upgrade Splunk Enterprise version(nix) ... View more

Yes. ... View more

I have just found a solution for the eventhub offset issue within the MSCS app.  Just deactivate the modular input, then go to  Splunk\var\lib\splunk\modinputs\mscs_azure_event_hub and delete the according file [eventhubnamespace]-[eventhub]-$Default.v1.ckpt  and reactivate the input. Splunk will recreate the file with a corrected timestamp and will reload the missing events from the eventhub. ... View more

This is the answer. What version of Splunk was this feature implemented? ... View more

Here's a possible explanation for the interruption some folks are seeing. We observed the same behavior today with our on-prem Splunk heavy-forwarder not getting events from the CrowdStrike Falcon Event Streams API for the past 7 days.  We eventually found that the past 7 days of "missing" events were getting pulled into our Splunk Cloud stack where we also had deployed CrowdStrike Falcon Event Streams add-on for Splunk.  i.e., we had 2 separate Splunk deployments requesting the same data.  It seems that only one API "client" instance would always get the data, and the other left out to dry. When we disabled the input configured on Splunk Cloud, the Splunk on-prem HF started to get the event stream again, collecting all 7 days of "missing" events as well as new events. To enable dual inputs, we plan to configure a separate CrowdStrike API key for the Splunk Cloud stack. I hope this helps others who've seen this issue. ... View more

Having exactly the same issue.. Have you found a solution for it? ... View more

Thanks this worked.  After calling in support from Splunk side (wasnt able to help due to vendor app), totally understand, also called in support to Service now, which had no idea about the add-on (https://splunkbase.splunk.com/app/4770/)   this fixed our issue with getting notable events into service now for alerting by tweaking that (mode="rt") Thanks ... View more

Hello, were you able to solve the problem? The same is happening to me. Thanks.  ... View more

Good afternoon @guarisma ! Unfortunately, the "rank" field is deprecated in version 2.1 of the SentinelOne API. v5.1.X of the Splunk Integration uses v2.1 of the API, hence the discrepancy. Please direct further questions to SentinelOne support for follow up. Thank you! ... View more

You're right but the examples in the documentation ignore the the protocol in the URL, but we'll give it a try. Monitor Active Directory - Splunk Documentation # Use the pri01.eng.ad.splunk.com domain controller to get all AD metadata for # the Computers OU in this forest. We want schema data for the entire AD tree, not # just this node. [admon://DefaultTargetDc] targetDc = pri01.eng.ad.splunk.com startingNode = OU=Computers,DC=eng,DC=ad,DC=splunk,DC=com   Thanks     ... View more

Any updates? Where can I get this beta version 2.0.8?  ... View more

This is actually not very easy to do with the default Windows DNS logging.  Firstly, to populate the Network Resolution, one would need to correlate request and response records.  But beyond that, Microsoft logs DNS at a debug level and logs are multiple lines long and very difficult to parse. Splunk does do the aggregation and parsing in the Stream app, but even that does not handle the datamodel mapping.  A shame really, because it is not really clear how the Network Resolution model is supposed to be used with a number of DNS return types. ... View more

I would do it by including  _time in the tstats' by statement | tstats count where index=* by _time index | timechart span=1mon sum(count) by index   ... View more

HI I am facing the same issue  , were you able to connect the Event Hub  ? thanks  ... View more

I am having the same issue. Did you end up resolving this? ... View more

Yeah, this is available in the audit index too. Please accept the answer if this answered your questions index=_audit action=indexes_edit ... View more

![alt text][1]Looks like here is what is required. has to same version of driver; else HF is not loading it and will not show as installed. https://1drv.ms/u/s!AgFp48BMOX6ghAwGgjD2xMDGTNS4?e=JycTnD ... View more

OK, so if you are looking for only the latest events then you just might need to use a time function like latest() to filter out the old events you don't want for the report https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Timefunctions <your search here> | stats latest(User) AS User by Action ... View more