Splunk Enterprise Security

How do enable Extreme Search command in ES App?

urbach
Explorer

After updating to ES App version 5.3.1, the extreme search commands no longer exist.

An error message is shown that the command is not found.

e.g.

Search: Access - Authentication Failures By Source - Context Gen

Unknown search command 'xsupdateddcontext'.

Labels (1)
0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

The Splunk Machine Learning Toolkit (MLTK) replaced Extreme Search:
https://docs.splunk.com/Documentation/ES/6.1.1/Admin/MLTKoverview

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Extreme Search is not replaced until ES 6.0.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...