All Apps and Add-ons

Why after installing the CrowdStrike App for Splunk do all of my data model searches run slow?

Builder

After installing the CrowdStrike app for Splunk, version 1.0.4, any saved/scheduled/correlation search using tstats are running extremely slow.

0 Karma
1 Solution

Builder

The CrowdStrike Falcon App for Splunk version 1.0.4 ships with a macro called summariesonly which translates to "summariesonly=false". Because of how configurations are merged, Splunk was using the macro from this app instead of the pre-configured macro that ships with ES. Disabling CrowdStrike's macro fixed this for me.

View solution in original post

0 Karma

Builder

The CrowdStrike Falcon App for Splunk version 1.0.4 ships with a macro called summariesonly which translates to "summariesonly=false". Because of how configurations are merged, Splunk was using the macro from this app instead of the pre-configured macro that ships with ES. Disabling CrowdStrike's macro fixed this for me.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!