How do enable Extreme Search command in ES App? - Splunk Community

Splunk Enterprise Security

After updating to ES App version 5.3.1, the extreme search commands no longer exist.

An error message is shown that the command is not found.

e.g.

Search: Access - Authentication Failures By Source - Context Gen

Unknown search command 'xsupdateddcontext'.

The Splunk Machine Learning Toolkit (MLTK) replaced Extreme Search:
https://docs.splunk.com/Documentation/ES/6.1.1/Admin/MLTKoverview

Extreme Search is not replaced until ES 6.0.

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...