topic Context is not updated for the 'Substantial Increase in Port Activity' ES Correlation Search in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Context-is-not-updated-for-the-Substantial-Increase-in-Port/m-p/386130#M4030 <P>The search "Network - Port Activity By Destination Port - Gen Context" returns more than 65000 dest_port, however the context is not updated with all ports.</P> <P>What could be failing?</P> Tue, 07 Aug 2018 04:54:41 GMT macapretorian 2018-08-07T04:54:41Z Context is not updated for the 'Substantial Increase in Port Activity' ES Correlation Search https://community.splunk.com/t5/Splunk-Enterprise-Security/Context-is-not-updated-for-the-Substantial-Increase-in-Port/m-p/386130#M4030 <P>The search "Network - Port Activity By Destination Port - Gen Context" returns more than 65000 dest_port, however the context is not updated with all ports.</P> <P>What could be failing?</P> Tue, 07 Aug 2018 04:54:41 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Context-is-not-updated-for-the-Substantial-Increase-in-Port/m-p/386130#M4030 macapretorian 2018-08-07T04:54:41Z