Hello community,
I'm encountering an issue while working with custom content in Splunk Security Essentials. I have created a custom content with this search :
index=windows sourcetype=WinEventLog
| stats count(eval(action="success")) as successes count(eval(action="failure")) as failures by src
| where successes>0 AND failures>100
However, when I navigate to the content under "Content -> Security Content" and attempt to save this as a scheduled search, the option "Save Scheduled Search" is not available. I noticed that in the pre-existing content, such as "Basic Brute Force," this option is present.
Could you please advise on why this option might not be appearing for my custom content? Are there any additional steps or configurations required to enable this feature for custom content?
Thank you for your assistance!
Best regards
Splunk Security Essentials
