Splunk Enterprise Security

Community Activity

Export the raw source files Is there a way to export each raw source files? Example of my search criteria: index="con1_batch" source="/PB00E5/l... by sinha73 New Member in Splunk Enterprise Security 08-02-2021 0 1	0	1
sendmodalert - action=risk STDERR - ERROR: [Errno 2] No such file or directory: u'/opt/splunk/var/run/splunk/dispatch/scheduler***/results.csv.gz' I'm trying to dynamically add risk modifiers with sendalert for Enterprise Security. The ad-hoc search works and adds... by brotheh New Member in Splunk Enterprise Security 08-02-2021 0 4	0	4
Extracting values from a field Hello Splunker usernames in my environment are shown as :user=Company\username@AD# where the # is a numberand some u... by moayadalghamdi Path Finder in Splunk Enterprise Security 08-02-2021 0 2	0	2
Change Data Presentation in Single Value Visualization Hello Splunkers.i made a splunk search to count the number of blocked URLs as a single value in a one day span of 3da... by moayadalghamdi Path Finder in Splunk Enterprise Security 08-01-2021 0 1	0	1
Can OpenJDK bundled within Splunk 8.0.1 in splunk-archiver be deleted? I recently upgraded Splunk from 7.3 to 8.0.1 and ES correspondlingly. Since doing that, my vulnerability scanner is ... by isbjorn Engager in Splunk Enterprise Security 08-01-2021 3 5	3	5
Do u please have a few useful Correlation searches (SPLs) related to UBA for ES? I need a few useful Correlation searches (SPLs) to keep a close eye on user (internal or malicious) behavior in ES pl... by SamHTexas Builder in Splunk Enterprise Security 07-31-2021 0 1	0	1
ES Threat Intel unable to capture hash values from csv upload Hi,I am trying to upload a custom CSV for Threat Intel within ES. It's a collection of multiples types of IOC's, (dom... by att35 Builder in Splunk Enterprise Security 07-30-2021 0 0	0	0
Data model acceleration not sticking Hi All,I'm not that familiar with DMA as I have not had any exposure really to setting up data models so far but am c... by MKozanic Path Finder in Splunk Enterprise Security 07-30-2021 0 5	0	5
Logs are coming in Hex We are testing a study on routing logs from an e-mail security product we have used to the SIEM environment. In this ... by xian New Member in Splunk Enterprise Security 07-29-2021 0 0	0	0
Enteprise Security and notable events creation issue Dear all I have an issue with a new dedicated Search Head for ES. My Splunk architecture is quite simple. 4 clustere... by vinz2020 Explorer in Splunk Enterprise Security 07-29-2021 0 2	0	2
How do I access a list of Saved searches for different apps. To change their timing in ES? Any helpful SPLs ? Thank u I need to access these saved searches & change their timing due to them conflicting / running at the same time so man... by SamHTexas Builder in Splunk Enterprise Security 07-27-2021 0 3	0	3
Monitoring MS SQL logs from Windows Event viewer Hi All, We need to integrate MS SQL logs with Splunk. The current default add-on supports logs via DB Connect but we... by akshatj2 Path Finder in Splunk Enterprise Security 07-27-2021 0 10	0	10
How do I check my long list of Indexes for "good health". Making sure they are healthy & working? I need to run a check on my Indexes making sure they are healthy. Where & how do I do it? Thank u very much in advanc... by SamHTexas Builder in Splunk Enterprise Security 07-26-2021 0 2	0	2
how do i search for failed login attempts and lockouts hello all I am fairly new to using Splunk and would like some help with searching for locked accounts and to Setup an... by stayready40 Engager in Splunk Enterprise Security 07-26-2021 0 3	0	3
Error when upgrading to Splunk Enterprise Security 6.0 Hi. I have some problems upgrading to Splunk ES 6.0. Normally I've just done the upgrade in the UI, no problem. Howe... by hettervik Builder in Splunk Enterprise Security 07-22-2021 4 6	4	6
What Health Check items are recommended in Monitoring Console for ES. Thank u I need to provide HA & better performance in MC for the Enterprise Console (ES) what health check items in MC or DMC ... by SamHTexas Builder in Splunk Enterprise Security 07-22-2021 0 0	0	0
share job link Hi,User needs a link which has the splunk qurery and resultsHe wants to attach the link to already existing dashboard... by VijaySrrie Builder in Splunk Enterprise Security 07-22-2021 0 1	0	1
tag=registry Hi,I am forwarding sysmon logs to splunk, for normalization, I could see event ID : 12, 13, 14 are captured (Registry... by VijaySrrie Builder in Splunk Enterprise Security 07-22-2021 0 1	0	1
Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew Hello my friends I had a problem for 2 days I am not allowed to search in Splank Thankful by hamidreza123 New Member in Splunk Enterprise Security 07-21-2021 0 1	0	1
How to correlate 4688 Process created and Logon 4624 events Hi,Can someone help me in correlating 4688 Process created and Logon 4624 events?I tried using the Transaction and S... by itssuresh07 New Member in Splunk Enterprise Security 07-20-2021 0 2	0	2
Integrate Data/Information from Splunk App I want to integrate data from a Splunk App to the Vuln centre in Enterprise Security. Has anyone done this before? by oylkm Explorer in Splunk Enterprise Security 07-19-2021 0 0	0	0
Search Notables for Open and Closure Times Hi Everyone,I am trying to write a query that will allow me to use my notable_events table, display the time the nota... by splunkeradmin22 New Member in Splunk Enterprise Security 07-16-2021 0 1	0	1
How to integrate email alerts into splunk Hi, I want to integrate emails from particular DL into splunk and splunk should create alerts for that traffic. by naregayam New Member in Splunk Enterprise Security 07-15-2021 0 5	0	5
Audit trail for investigations An analyst adds a note to investigation. Another analyst from another shift delete this note.where is the audit trail... by efika Communicator in Splunk Enterprise Security 07-15-2021 1 0	1	0
How to search by time using \|rest command I'm searching using the \| rest command from search bar. Attempting to find saved searches that have been modified in... by wtaylor149 Explorer in Splunk Enterprise Security 07-15-2021 0 2	0	2