- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After installing the CrowdStrike app for Splunk, version 1.0.4, any saved/scheduled/correlation search using tstats are running extremely slow.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The CrowdStrike Falcon App for Splunk version 1.0.4 ships with a macro called summariesonly which translates to "summariesonly=false". Because of how configurations are merged, Splunk was using the macro from this app instead of the pre-configured macro that ships with ES. Disabling CrowdStrike's macro fixed this for me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The CrowdStrike Falcon App for Splunk version 1.0.4 ships with a macro called summariesonly which translates to "summariesonly=false". Because of how configurations are merged, Splunk was using the macro from this app instead of the pre-configured macro that ships with ES. Disabling CrowdStrike's macro fixed this for me.
