Hello the team, I am currently preparing a Splunk Lab for my office, and I need the datasets specially for Splunk Enterprise Security. I am trying to deploy a Splunk Entreprise Security (ES) environment in our Lab but we have a lack of data (Events, Notable Events, …)   Can u propose to me some datasets to aliment ES ? Otherwise, what u can propose as suggestions to deploy Splunk Enterprise Security in our Splunk Lab.   Thanks in advance for your help. Have a nice day. ... View more

Hello everyone,  I am working right now to collect logs from F5 BIG-IP. I have a distributed Splunk Infrastructure: Heavy Forwarder, Indexer & Search Head. I installed the Splunk Add-on for F5 BIG-IP in the Search Head and Heavy Forwarer instances as recommended in Splunk documentation here:  https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Install  Then, i discovered that Splunk Add-on for F5 BIG-IP is not separating sourcetypes as expected !!!  Also, maybe the last version of the Add-on for F5 BIG-IP (4.0.1) doesn't work with the version 16.0.0 of my F5 firewall. I read that somewhere ... But i am not sure about it!  Anyone have an idea please? Or, when the Add-On will be updated to support it.  PS : I'am working with Splunk Entreprise v8.0.4 ... View more

Hello everyone,  I want to install CTF_Scoreboard in Splunk. I follow the steps here : https://github.com/splunk/SA-ctf_scoreboard But, I didn't get the log files : scoreboard.log and scoreboard_admin.log in the repository /opt/splunk/var/log. After uploading all the questions and answers in my application scoreboard, i can't submit my responses in the app: I got an error : "404 Not Found". you can see the figures:  anyone can help me please! It's urgent! Thanks a lot. ... View more

Hello the Team, hope you are Okey!   I have a question about Fortinet FortiGate Add-On for Splunk which is available in splunkbase.com platform : https://splunkbase.splunk.com/app/2846/#/details. I am deploying a distributed Splunk Enterprise infrastructure with a Heavy Forwarder, Indexer and Search Head. I don’t know exactly in which instance I should  install the add-on? Is it in the search Head? Should I add data input on Heavy Forwarder Instance? I didn’t really find a clear procedure for the installation and the configuration.   I have to implement a BOSS Of The SoC environment (so the datasets are already available on GitHub web site)   Thanks, In advance. Waiting for your response, ... View more