Splunk Enterprise Security

Community Activity

Reduce data model summaries I have a data model that has grown quite large, over 7TB for Network Sessions. Its set to 3 months accelerated. I wan... by tkw03 Communicator in Splunk Enterprise Security 06-15-2020 0 1	0	1
How to add custom field to Splunk ES Asset dataset I am new to Splunk and have a question about Asset and Identity data modle. We are on ES 5.3.0. I am trying to load ... by hpwang1014 New Member in Splunk Enterprise Security 06-11-2020 0 3	0	3
How to make Stream logs CIM compliant I've used Splunk Stream app to get DNS logs from a Windows DNS server. I got the logs to a Search Head instance that... by akhalfan Engager in Splunk Enterprise Security 06-10-2020 0 5	0	5
How to display count of two different fields with different values? Hello all I'm having difficulties figuring out how to output 2 seperate counts for 2 seperate fields. index=email sp... by i471 New Member in Splunk Enterprise Security 06-04-2020 0 2	0	2
Map command doesn't show results for some fields, even though log shows values parsed out correctly? I have created a search in order to: Pull traffic log from datamodel "DM_1"Use src_ip and dest_ip as token to pass ma... by patricknguyen Explorer in Splunk Enterprise Security 06-03-2020 0 0	0	0
Can you convert identities_expanded to a KVStore? We are using Splunk ES version 5.2. The size of the indentities_expanded CSV file is over 350MB and is causing issues... by stevenbutterwor Path Finder in Splunk Enterprise Security 06-03-2020 0 2	0	2
Notable Event Suppression where field is NULL? Trying to create an ES Notable Event Suppression where the user value is null.A direct search: `get_notable_index` \|... by richardphung Communicator in Splunk Enterprise Security 06-03-2020 0 1	0	1
How do I add static Tag options to the ES Incident Review Dashboard? In Tag section of the ES Incident Review Page, is it possible to have specific tags selectable, rather than having to... by malvidin Communicator in Splunk Enterprise Security 06-03-2020 0 0	0	0
How do enable Extreme Search command in ES App? After updating to ES App version 5.3.1, the extreme search commands no longer exist. An error message is shown that t... by urbach Explorer in Splunk Enterprise Security 06-02-2020 0 2	0	2
ESCU-Investigate Return Blank Page Hi splunkers, When ı research in incident review ı saw rare process alert And Next-Steps - ESCU-Investigate Press Cli... by burakatabay Path Finder in Splunk Enterprise Security 06-02-2020 5 2	5	2
i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert event status : False positive (25 may)False positive (24 may)Investigating (23 may)Investigating (22 may)Service degr... by mahendra559 New Member in Splunk Enterprise Security 06-02-2020 0 7	0	7
rdp monitoring Hi team, I have security events and process events get indexed to SPLUNK instance from windows... How to get to know ... by punithjigali Explorer in Splunk Enterprise Security 06-02-2020 0 0	0	0
How to create an alert that triggers when field value status changes? Actual requirement is when a status field value changes from one to another, an alert needs to be triggered.Below are... by mahendra559 New Member in Splunk Enterprise Security 06-01-2020 0 0	0	0
calculating average daily and monthly, Hi team, I have a process that get indexes daily for a certain duration.1) i want to get the duration it gets indexed... by punithjigali Explorer in Splunk Enterprise Security 06-01-2020 0 0	0	0
Enterprise Security Trial: too slow, service unavailable, search is waiting for an input Hello everyone, I signed up for the 7 days evaluation of Splunk Enterprise Security and got the credentials and lin... by yasalhazmi New Member in Splunk Enterprise Security 05-30-2020 0 0	0	0
how wrirte search query for status change hear if we have a multiple same status is there it will pick only first status event and if the different status even... by mahendra559 New Member in Splunk Enterprise Security 05-29-2020 0 2	0	2
Splunk Enterprise Security does not show Security Posture Dear all, I have installed Splunk Enterprise Security but the Security Posture dashboard does not show any informatio... by m1ster1985 Explorer in Splunk Enterprise Security 05-28-2020 0 0	0	0
Vulnerabilities remediation over time Ok so my data is coming from a vulnerability management system. every day i get a dump of every vulnerability in the ... by jlovik Explorer in Splunk Enterprise Security 05-27-2020 0 0	0	0
How to customize date/time range in search? Hello, Rather than run three separate reports on three different dates, I'd like to run ONE report that only encapsul... by itsmevic Communicator in Splunk Enterprise Security 05-27-2020 0 2	0	2
DB Connect App generating data leak issue - each user with db_connect_user role has full access to all indexes Hi, I have installed Splunk Enterprise system with multiple users. Each our user has access only to specified index... by conwaw Explorer in Splunk Enterprise Security 05-27-2020 0 1	0	1
Can Splunk Dashboard draw a GEO Attack Graph ? As title ,Did anyone know how to plot alt textsuch attack graph in splunk? Can Splunk Dashboard draw a GEO Attack Gra... by briansylaw New Member in Splunk Enterprise Security 05-27-2020 0 2	0	2
Excessive DNS Queries - Whitelist? Hi all - I'm working to do a lot of cleanup in Splunk ES to cut down on some of the noise. The one area I'm having a ... by ctulumba Engager in Splunk Enterprise Security 05-26-2020 1 2	1	2
Endpoint Data model does not finish building. Hey guys, we have Enterprise Security and the Endpoint data model never finishes building. I even knocked the backfil... by tiaatim Path Finder in Splunk Enterprise Security 05-26-2020 0 0	0	0
How to add a PC name to a threat intel list for Splunk Enterprise Security? Hi Splunkers, We have an indicator of a phishing source from email headers - a PC name. We need to add it to a Threat... by evelenke Contributor in Splunk Enterprise Security 05-25-2020 0 3	0	3
Not able to view the prepolulated data on free trial enterprise security sandbox Search not executed: The minimum free disk space (995MB) reached for /opt/splunk/var/run/splunk/dispatch by amakwana New Member in Splunk Enterprise Security 05-25-2020 0 3	0	3