Splunk Enterprise Security

Community Activity

no instance is running in bots.splunk.com apthunting.splunk.show not able to access any instances mentioned in bots.splunk.com by evalkrishdee New Member in Splunk Enterprise Security Wednesday 0 0	0	0
ES 8: “Move to new queue” not available on custom team-based queues (works from the default analyst queue) Hi all,I’m running Splunk Enterprise Security 8.7.0 on Splunk Enterprise 10.2.3 . I can’t move findings out of team-b... by torgynnurlankul New Member in Splunk Enterprise Security 2 weeks ago 0 0	0	0
Error saving event-based detection. Missing detection_id for the detection= Unable to update and save detections after upgrading to Splunk ES version 8.1.0. It says Detection ID is missing. by BJ17 Explorer in Splunk Enterprise Security 3 weeks ago 0 5	0	5
Automatically run a playbook when an investigation starts from a finding Hello,I'm new to Splunk Enterprise Security and I'm building a flow where a finding triggers a playbook that simply s... by josep New Member in Splunk Enterprise Security 4 weeks ago 0 0	0	0
Seeking feedback on SIEM log integrity monitoring Hello, I am a cybersecurity engineering student and I am currently in the final stage of an international cybersecuri... by feridmehtiyev1 Engager in Splunk Enterprise Security 09-22-2026 1 10	1	10
ES Mission control auto refresh We are setting up Mission Control as the main dashboard in our operations center (which handles both NOC and SOC sinc... by AvocadoLogs Engager in Splunk Enterprise Security 09-21-2026 1 2	1	2
JSON Feed Parsing for URL-Based Threat Intelligence in Splunk ES 8.x Hi,Does Splunk Enterprise Security 8.x support JSON feeds directly as a URL-based threat intelligence source?If yes, ... by Latefa New Member in Splunk Enterprise Security 09-18-2026 0 1	0	1
Is there any documentation about this App? Hi All,Is there any documentation describing setting this app for integration between Splunk ES and Google SecOps? I ... by sergzin New Member in Splunk Enterprise Security 09-15-2026 0 0	0	0
How to view data from Threat intel collections? Hello, Like any other ES user, we have threat intel feeds configured that came along with box. How can i view the ac... by neerajs_81 Builder in Splunk Enterprise Security 09-07-2026 0 2	0	2
Salesforce integration with Splunk Hello Splunkers,I have a question around integration of Salesforce with Splunk , I see there are two Add-on available... by mohsplunking Path Finder in Splunk Enterprise Security 08-30-2026 0 1	0	1
Add Threat Intelligence: Threat Group - No Matches- Hi,I have rule to detect some suspicious activity and want to add the source IP into the ES Threat Intel, However Thr... by 0xAli Path Finder in Splunk Enterprise Security 08-23-2026 0 1	0	1
Investigations disappearing in Analyst Queue I have recently installed Splunk Enterprise Security v8.4 on a fresh Splunk instance after successfully using v8.2 on... by Ian0706 Explorer in Splunk Enterprise Security 08-20-2026 0 5	0	5
ES 8.3.0 / 8.4 — investigations silently missing from Analyst Queue: traced to a skipped write to index=mc_investigation Following on from an earlier thread where investigations appear in the Analyst Queue for a second and then vanish. Th... by splunker_ak Explorer in Splunk Enterprise Security 08-20-2026 0 0	0	0
Unable to edit notable comments in incident review In splunk ES, a user is unable to edit/delete comments for most of the notables in incident review, however the same ... by maheshnc Path Finder in Splunk Enterprise Security 08-19-2026 0 0	0	0
CIM normalization on ES Splunk Cloud Classic - Use TA vs. staying in-app? Working on a large Splunk Cloud engagement (Classic Experience, ES on the premium search head) and want a sanity chec... by Fregault New Member in Splunk Enterprise Security 08-16-2026 0 0	0	0
Estimating license usage with metrics.log Hello, when using these queries I can see difference between HF and IDX measures :index=_internal source=*metrics.log... by splunkreal Influencer in Splunk Enterprise Security 08-07-2026 0 2	0	2
Splunk Enterprise Security: Invalid Stanza Dev Prod Hi all,Anyone face the below, and how to get ride of it: by 0xAli Path Finder in Splunk Enterprise Security 08-06-2026 0 4	0	4
Splunk Enterprise Security Certififed Admin Hello,Since the Splunk Enterprise Security Certified Admin certification is now classified as a legacy certification,... by Safia_LSD Engager in Splunk Enterprise Security 08-06-2026 1 2	1	2
Notable why the notable disappear from mission control after clicking start investigation button by kjain041523 Observer in Splunk Enterprise Security 08-04-2026 0 0	0	0
Hide findings not suppressing findings that are part of a finding group (ES 8.5.1) — worked fine in 8.3 Environment: Splunk Enterprise Security 8.5.1 (on-prem)I have "Hide findings" turned on under Configure → Findings an... by Agent Explorer in Splunk Enterprise Security 07-31-2026 0 0	0	0
Splunk query vs Splunk search Hi,I just want to understand what is the exact difference between query and search.Thanks by _Raj Path Finder in Splunk Enterprise Security 07-30-2026 0 2	0	2
Unable to delete saved searches owned by admin user in Splunk Enterprise Security Hi everyone,I'm currently facing an issue that I have not been able to resolve and would appreciate your guidance.We ... by dairontorresz Engager in Splunk Enterprise Security 07-28-2026 0 1	0	1
Local Processes Tracker lookup localprocesses_tracker issue with spaces in process name/path The "Local Processes Tracker" from SA-EndpointProtection maintains a list of all processes on each system and the fi... by vvanlier Explorer in Splunk Enterprise Security 07-28-2026 2 3	2	3
Event-Based Detection findings appear both inside and outside Finding Group in ES 8.5 Greetings everyone,I was using ES 8.3 and when I created a finding-group based on a event based finding it only showe... by Elina Engager in Splunk Enterprise Security 07-26-2026 0 0	0	0
Enterprise Security - Entity zones Hi,I'm currently looking into ES entity zones and am a bit confused about the process.The cim data model documentatio... by peterschloenske Explorer in Splunk Enterprise Security 07-22-2026 0 0	0	0