Known Issues

Alternatively edit /etc/hosts and create the link between IPaddes and SH_fqdn_hostname into each search head cluster

Alternatively, you can disable the search head cluster redirection framework. However, this can lead to data loss or data corruption. Eg: Duplicate HRIDs. You can mitigate this by using the KV captain only for all the UI flows.

If you are using Splunk Enterprise Security (on-prem), run the following CURL command:curl -k --location "https://<hostname>:8089/servicesNS/nobody/missioncontrol/configs/conf-infra/cloud?output_mode=json" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "disable_api_redirection=<true/false>"

If you want to disable the search head cluster redirection framework but you are not using Splunk Enterprise Security (on-prem), open a support ticket on the Splunk Support portal.

add `| fields - source` to end of search

Alternatively edit /etc/hosts and create the link between IPaddes and SH_fqdn_hostname into each search head cluster

Alternatively, you can disable the search head cluster redirection framework. However, this can lead to data loss or data corruption. Eg: Duplicate HRIDs. You can mitigate this by using the KV captain only for all the UI flows.

If you are using Splunk Enterprise Security (on-prem), run the following CURL command:curl -k --location "https://<hostname>:8089/servicesNS/nobody/missioncontrol/configs/conf-infra/cloud?output_mode=json" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "disable_api_redirection=<true/false>"

If you want to disable the search head cluster redirection framework but you are not using Splunk Enterprise Security (on-prem), open a support ticket on the Splunk Support portal.

add `| fields - source` to end of search

Alternatively edit /etc/hosts and create the link between IPaddes and SH_fqdn_hostname into each search head cluster

Alternatively, you can disable the search head cluster redirection framework. However, this can lead to data loss or data corruption. Eg: Duplicate HRIDs. You can mitigate this by using the KV captain only for all the UI flows.

If you are using Splunk Enterprise Security (on-prem), run the following CURL command:curl -k --location "https://<hostname>:8089/servicesNS/nobody/missioncontrol/configs/conf-infra/cloud?output_mode=json" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "disable_api_redirection=<true/false>"

If you want to disable the search head cluster redirection framework but you are not using Splunk Enterprise Security (on-prem), open a support ticket on the Splunk Support portal.

add `| fields - source` to end of search

Alternatively edit /etc/hosts and create the link between IPaddes and SH_fqdn_hostname into each search head cluster

Alternatively, you can disable the search head cluster redirection framework. However, this can lead to data loss or data corruption. Eg: Duplicate HRIDs. You can mitigate this by using the KV captain only for all the UI flows.

If you are using Splunk Enterprise Security (on-prem), run the following CURL command:curl -k --location "https://<hostname>:8089/servicesNS/nobody/missioncontrol/configs/conf-infra/cloud?output_mode=json" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "disable_api_redirection=<true/false>"

If you want to disable the search head cluster redirection framework but you are not using Splunk Enterprise Security (on-prem), open a support ticket on the Splunk Support portal.

add `| fields - source` to end of search

1. Stop the Datamodel acceleration (if enabled) which has these field missing under the field list: _time=* sourcetype=* host=* source=*
2. Add these missing fields into each dataset

_time=* sourcetype=* host=* source=* (could be necessary to add index="NAME OF THE INDEXES" unless specified within the linked macro

1. Edit the dataset extracted fields and checkbox _time=* sourcetype=* host=* source=*
2. save the changes
3. enable acceleration if it was enabled
4. edit affected threat matching datasets by adding these matching fields

{noformat}administrative_reload (modinput) -> adminstrative_redload.py -> packages/app-ess/apps/SA-ThreatIntelligence/package/bin/reviewstatuses_rest_handler.py handleReload function -> Read conf file and updates the kvstore record{noformat}

Alternatively edit /etc/hosts and create the link between IPaddes and SH_fqdn_hostname into each search head cluster

Alternatively, you can disable the search head cluster redirection framework. However, this can lead to data loss or data corruption. Eg: Duplicate HRIDs. You can mitigate this by using the KV captain only for all the UI flows.

If you are using Splunk Enterprise Security (on-prem), run the following CURL command:curl -k --location "https://<hostname>:8089/servicesNS/nobody/missioncontrol/configs/conf-infra/cloud?output_mode=json" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "disable_api_redirection=<true/false>"

If you want to disable the search head cluster redirection framework but you are not using Splunk Enterprise Security (on-prem), open a support ticket on the Splunk Support portal.

add `| fields - source` to end of search

G-drive link for SH diag - [1]

1. Stop the Datamodel acceleration (if enabled) which has these field missing under the field list: _time=* sourcetype=* host=* source=*
2. Add these missing fields into each dataset

_time=* sourcetype=* host=* source=* (could be necessary to add index="NAME OF THE INDEXES" unless specified within the linked macro

1. Edit the dataset extracted fields and checkbox _time=* sourcetype=* host=* source=*
2. save the changes
3. enable acceleration if it was enabled
4. edit affected threat matching datasets by adding these matching fields

In order to disable a detection that was created in this state, go to {{Settings -> Searches, reports and alerts}} and disable/delete the detection there.

In order to disable a detection that was created in this state, go to {{Settings -> Searches, reports and alerts}} and disable/delete the detection there.

The workaround is to manually force the the Delim_regex= to be as equal as the Extract_regex stanza. A debug/refresh should be sufficient OR SH restart may be necessary after the change.

If you are using SHC feel free to push changes from the deployer these settings are saved within inputs.conf inside .\etc\apps\SA-ThreatIntelligence\local\inputs.conf

splunk@so1:/opt/splunk/etc/apps/SA-ThreatIntelligence/local$ grep emmanuetest -A 25  inputs.conf 

{noformat}[threatlist://emmanuetest] extract_regex = ^\|\|((?:\d{1,3}\.){3}\d{1,3})|^\|\|([a-zA-Z0-9*.-]+\.[a-zA-Z]{2,}) delim_regex = ^\|\|((?:\d{1,3}\.){3}\d{1,3})|^\|\|([a-zA-Z0-9*.-]+\.[a-zA-Z]{2,}){noformat}

add `| fields - source` to end of search

G-drive link for SH diag - [1]