All Apps and Add-ons

Why after installing the CrowdStrike App for Splunk do all of my data model searches run slow?

dflodstrom
Builder

After installing the CrowdStrike app for Splunk, version 1.0.4, any saved/scheduled/correlation search using tstats are running extremely slow.

0 Karma
1 Solution

dflodstrom
Builder

The CrowdStrike Falcon App for Splunk version 1.0.4 ships with a macro called summariesonly which translates to "summariesonly=false". Because of how configurations are merged, Splunk was using the macro from this app instead of the pre-configured macro that ships with ES. Disabling CrowdStrike's macro fixed this for me.

View solution in original post

0 Karma

dflodstrom
Builder

The CrowdStrike Falcon App for Splunk version 1.0.4 ships with a macro called summariesonly which translates to "summariesonly=false". Because of how configurations are merged, Splunk was using the macro from this app instead of the pre-configured macro that ships with ES. Disabling CrowdStrike's macro fixed this for me.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!