Cross Application Search

hartfoml · ‎11-10-2011

I am useing the Global Threat Landscape (GTL) app and like it

I wan to build a report that shows any of the IP's on the IP_Watchlist that have contacted my firewall. I would like to see this type of report.

top 10 Offending_IP, Country, Destination_IP, Destination_DNS_Name, Firewall_Action

My question is how do I use the GTL offending_ip and country lookup info to search my firewall logs for connection state?

joshd · ‎11-10-2011

Change the permissions of the app so the "Sharing for config file-only objects" is set to "All apps" .. then all the other apps will be able to see what's available in that specific app.

Cross Application Search

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Cross Application Search

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas