Splunk Enterprise Security

Community Activity

Does Splunk ES live entirely within etc/apps? Is there any component that makes Splunk ES tick, which isn't inside the directory etc/apps? by andrewaalin Explorer in Splunk Enterprise Security 06-25-2018 0 1	0	1
Comparison chart of data indexed per index over one week Greetings Splunkers, My question is two fold. I'm in need of an SPL that will show how much data was indexed per i... by CodyQ Explorer in Splunk Enterprise Security 06-25-2018 0 2	0	2
Using certificate-based auth for a TAXII Threat Intel download? I notice that Splice was deprecated as ES (allegedly) did everything Splice did, however one thing Splice supported t... by AGLbwa Path Finder in Splunk Enterprise Security 06-23-2018 0 3	0	3
modular_actions_invocations macro Hi all, Does anyone have any knowledge or understanding with the macro "modular_actions_invocations(2)"? This is a m... by btanjialih Explorer in Splunk Enterprise Security 06-21-2018 0 2	0	2
alert triggered but ip not available in csv Hello Folks, I have enabled a notable in ES_app, which triggers if it finds any ip available from local_ip_intel.csv... by srisahitya_v Communicator in Splunk Enterprise Security 06-21-2018 1 0	1	0
Complex RegEx Capturing Group Assistance Complex RegEx Capturing Group Assistance I have a couple similar cases where I am struggling to get the desired fiel... by draracle Engager in Splunk Enterprise Security 06-21-2018 0 4	0	4
How to resolve replication errors on knowledge bundle size over 200MB due to Splunk Enterprise Security identities and assets? Hi, I'm looking for some answer and suggestion how I could decrease/workaround the knowledge bundle replication erro... by tkiss Path Finder in Splunk Enterprise Security 06-20-2018 0 3	0	3
How to populate malware_alias with TAXII feeds? Hello everyone! Does anyone know how can I populate the "malware_alias" field with TAXII/STIX objects? I have tried ... by eldadintsights New Member in Splunk Enterprise Security 06-20-2018 0 0	0	0
Splunk - Enterprise Security - Disable Splunk Web Messages How can I selectively disable/suppress Splunk web messages? This one is quite a nuisance and quite obviously a bug of... by SMWickman Explorer in Splunk Enterprise Security 06-19-2018 3 1	3	1
How to find time values that are over 90 days old? Hi, I have 2 fields I would like to only display lastLogonTimestamp values that are over 90 days of the **_time... by ajdyer2000 Path Finder in Splunk Enterprise Security 06-18-2018 0 5	0	5
How to create matching log with CIM "proxy" data model to see information in ES? I'm receiving logs from a Barracuda Web Security Gateway into splunk. I've created a field extraction rule inline, ge... by DBuhler Explorer in Splunk Enterprise Security 06-18-2018 1 4	1	4
Is it possible to manually add values to a dashboard panel? I am trying to count the number of events that I am unable to send to Splunk. I need these in a dashboard where I can... by nate_c New Member in Splunk Enterprise Security 06-18-2018 0 1	0	1
Retrieve/download the original source file(s) after a search Is there a way to download the sourcefile in the web interface or does it have to be done through the CLI? If it is d... by memphisft3 Engager in Splunk Enterprise Security 06-17-2018 1 2	1	2
How can I compare the bandwidth usage of a specific category to the bandwidth usage of all categories combined? For some reason I'm hitting a wall on the logic of this search. I'm working with Palo Alto logs and the fields i'm i... by digital_alchemy Path Finder in Splunk Enterprise Security 06-16-2018 0 4	0	4
Splunk ES: collecting Assets from vCenter Is there a suggested collection method for Assets (for Splunk ES), from vCenter? I see the page "Collect and extract... by andrewaalin Explorer in Splunk Enterprise Security 06-14-2018 0 4	0	4
Error after installnig Splunk Enterprise Security 5.0 Install on 6.3 leads to web integer literal error I installed 6.3 Splunk Enterprise and then went to install Splunk Enterprise Security 5.0 SPL and after the installat... by doodoodonk Engager in Splunk Enterprise Security 06-14-2018 0 0	0	0
Unable to install PhishTank app in Splunk ES Hi Nimish Doshi, We are unable to install the phish tank app in our splunk instance. We reached to our support team ... by venkatesh_gopal New Member in Splunk Enterprise Security 06-13-2018 0 2	0	2
Splunk CIM Validator: Issue Field validation error "no validation regex was found to evaluate" While validating the varonis logs using Splunk CIM Validator App, I am getting following error "no validation regex w... by dheerajdwiv Engager in Splunk Enterprise Security 06-13-2018 0 0	0	0
Is it possible to resolve remote hostname using most recent DNS query by local hostname? I'm new to Splunk and it is not quite clear to me how one would assign hostnames to remote computers based on the DNS... by kje New Member in Splunk Enterprise Security 06-13-2018 0 3	0	3
Multple Enterprise Security clusters to one search peer pool Is it possible to have two instances of ES searching the same search peer pool? by jcampbell1977 Explorer in Splunk Enterprise Security 06-12-2018 0 1	0	1
Splunk Enterprise Security tutorials and sample data dump I have used that search tutorials for splunk.Is there any similar one splunk ES?!?! For splunk, there is a tutorials ... by inventsekar SplunkTrust in Splunk Enterprise Security 06-12-2018 0 2	0	2
Dnstwist full TLD list This is more of a feature request than a proper question. Is it possible to generate the a full tld list instead of... by jorgepinto1 Explorer in Splunk Enterprise Security 06-12-2018 0 0	0	0
Splunk Add-on for Unix and Linux vs Linux Auditd Hello, For planned test environment with ES I'm trying to see what fit better to my scenario. I can see that Splunk ... by a_naoum Path Finder in Splunk Enterprise Security 06-11-2018 1 3	1	3
Filtering non-compliant Machines from forescout logs We have events feeding into splunk from ForeScout logs (no forescout APP) and i would like to filter it so that only ... by DSIre New Member in Splunk Enterprise Security 06-11-2018 0 0	0	0
Enterprise Security in Splunk 7.1 There appears to be issues with Splunk Enterprise on Splunk 7.1 Is there a reason that the Incident Review "Urgency"... by jowenssi Path Finder in Splunk Enterprise Security 06-11-2018 0 18	0	18