Splunk Enterprise Security

Community Activity

	Splunk ES 8.x – ServiceNow Integration: Incident Sync & Mission Control Updates Splunk ES 8.x – ServiceNow Integration: Incident Sync & Mission Control UpdatesContext We are implementing Splunk Ent... by MissionSplunker New Member in Splunk Enterprise Security 07-08-2026 0 0	0	0
	Rolling window & scheduling for Splunk ES detections Hello all,I have some questions concerning the scheduling of detections.How do the rolling window for alerts work ? D... by robertoClaros Explorer in Splunk Enterprise Security 07-08-2026 0 5	0	5
	multi-Search Head deployment (ES + Non-ES) feeding into an Indexer Cluster and Splunk_TA_ForIndexers deployment If I have a Splunk deployment with two Search Heads (one dedicated to Enterprise Security and one for core Splunk) an... by Wohamed_wakkad Explorer in Splunk Enterprise Security 07-04-2026 0 3	0	3
	Enterprise Security stops creating Mission Control Findings although correlation searches continue to run Hi everyone,I’m currently troubleshooting an issue in a Splunk Enterprise 10.2.4 environment running Splunk Enterpris... by adedwiky New Member in Splunk Enterprise Security 06-27-2026 0 2	0	2
	Splunk ES upgrade path from 7.3.4 to 8.5.1 Hi,Kindly, we plan to upgrade from the Splunk ES 7.3.4 to the latest 8.5.1.please confirm the upgrade path wil be dir... by 0xAli Path Finder in Splunk Enterprise Security 06-24-2026 0 1	0	1
	When will the AI assistant for ES be available for OnPrem instances? Does anybody know when will the AI Agent for ES be available for OnPrem instances?Splunk said that it will be first a... by javier_oshiro Explorer in Splunk Enterprise Security 06-18-2026 0 2	0	2
	Enterprise Security 8.5.1 Team Queue are is blank in a cluster After upgrading ESS from 8.2.x to 8.5.1 the teams queue is blank. It just shows "Queues" and the rest is empty.New te... by dspencer Path Finder in Splunk Enterprise Security 06-17-2026 0 1	0	1
	Configured Detections Have Disappeared from All Automation Rules HelloI'm experiencing an issue with Automation Rules in Splunk Enterprise Security (8.5.1). Sometimes I'm able to add... by shenglc New Member in Splunk Enterprise Security 06-17-2026 0 1	0	1
	any suggested template for ES dashboards KPI we just want to monitor one page dashboard for ES as well data source gap and SOC metrics if any one have any sample... by Splunkerai New Member in Splunk Enterprise Security 06-10-2026 0 0	0	0
	Splunk AI Assistant is only supported on Splunk Cloud Guys need help,We have successfully installed the Splunk AI Assistant application on our Search Head. However, we are... by Alkern Engager in Splunk Enterprise Security 05-21-2026 0 4	0	4
	Intermediate findings in analyst queue ES v8.3 Hello, us there still Intermediate findings column for findings in analyst queue for Event based detections?Thanks. by splunkreal Influencer in Splunk Enterprise Security 05-18-2026 0 5	0	5
	Senhasegura integration Guys I need to collect data and map to CIM for Enterprise Security senhasegura data but I could not find any app or a... by AceX Path Finder in Splunk Enterprise Security 05-13-2026 0 1	0	1
	Bulk update ESCU detections Is there a way to bulk update enabled ESCU detections when a new version with a lot of metadata changes like the MITR... by cseiler-gmp New Member in Splunk Enterprise Security 05-11-2026 0 2	0	2
	Inquiry Regarding Splunk AI Assistant Our company is currently using Splunk Enterprise Security, and we would like to ask a question regarding available fe... by Alkern Engager in Splunk Enterprise Security 05-11-2026 0 1	0	1
	Splunk ES \|\| DMA(datamodel_summary) And normal index What is the relationship between Splunk accelerated data models stored in the datamodel_summary index and the normal ... by Wohamed_wakkad Explorer in Splunk Enterprise Security 05-05-2026 0 5	0	5
	Test Triggering Events in Splunk Enterprise Hello, We have a large number of dashboards and queries in our Splunk instance, and some of those are meant for monit... by Sherminator Engager in Splunk Enterprise Security 04-30-2026 0 3	0	3
	Threat Intel: Add threat intelligence from Splunk events Hi Everyone,We have integrated Crowdstrike falcon with splunk and we retrieved the IOC in index=cs_ioc.Using the belo... by 0xAli Path Finder in Splunk Enterprise Security 04-25-2026 0 3	0	3
	Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation?cou Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/storage/investigation/investigation?... by jordanmorgan Observer in Splunk Enterprise Security 04-24-2026 0 1	0	1
	ES 8.0 Upgrade: "Yesterday" time modifier returning early-morning "Today" results compared to ES 7 We are currently in the process of upgrading from ES 7.x to ES 8.x and are performing a data validation/parity checks... by KevHaze Explorer in Splunk Enterprise Security 04-21-2026 0 3	0	3
	Adhoc search head: Best practisce Hi Everyone,I have a clustered SH (Install ES App) + Adhoc search head.I need to know what is the role of the adhoc S... by 0xAli Path Finder in Splunk Enterprise Security 04-17-2026 0 5	0	5
	Cloned Role Hello,I created a new role that is the same as ess_analyst but it doesn't have any inheritance, all the capabilities ... by dspencer Path Finder in Splunk Enterprise Security 04-10-2026 0 4	0	4
	Trouble getting an EBD to trigger a finding in 8.4 Hi,I am having trouble after coming from ES 7.x going through creating what I thought might be a simple Event Based D... by lmaclean Path Finder in Splunk Enterprise Security 04-09-2026 0 3	0	3
	Custom Role on ES Hello,I have create a custom role and assigned the same permissions as ess_user, including adding it to the enforce_e... by akai Explorer in Splunk Enterprise Security 04-09-2026 0 6	0	6
	Sendalert risk does not populate source_guid / source_event_id — UI-created risk events do Hi everyone,I’m seeing a discrepancy with the Risk Modular Alert Action in Splunk ES. When triggering the risk action... by Sky New Member in Splunk Enterprise Security 04-07-2026 0 1	0	1
	Error: Fail to fetch analyst queue data Please refresh or change the filters. After upgrading my Splunk Enterprise Security environment from 7.3.3 to 8.3.0, I’m seeing the following error on the ... by wrknh Engager in Splunk Enterprise Security 04-01-2026 0 2	0	2