Splunk Enterprise Security

Community Activity

Windows TA not Parsing "Error_Code" from 4776 Logs Searching: index=sec_windows source=wineventlog:security EventCode=4776 action=failure should return a field called ... by jerm1020rq Explorer in Splunk Enterprise Security 02-23-2020 0 1	0	1
Slpunk DB connect APP i am trying to query the Oracle DB using the statement attached in the case, the query works fine for the batch input... by malisushil New Member in Splunk Enterprise Security 02-23-2020 0 2	0	2
A Necessity of use cases related to Nessus and Windows. Hi all, We have the necessity to implements alerts related to Nessus scans and Windows systems. We have seen a few of... by leillo28 New Member in Splunk Enterprise Security 02-21-2020 0 1	0	1
CIM compliance of data from two different sources I have two set of questions on which I am looking for inputs. 1. I have data from multiple tables for an application.... by rajashekar_s Path Finder in Splunk Enterprise Security 02-20-2020 0 2	0	2
Feature Request: restrict the KPIs of a glass table in ES on refresh interval I would like to be able to restrict the KPIs of a glass table in ES on refresh interval. The refresh interval canno... by ggiessen Explorer in Splunk Enterprise Security 02-19-2020 0 2	0	2
Splunk business questions Hi Guys I am working for a new client that wants me to develop a monthly report/dashboard for their business. I am tr... by charlesukah22 Explorer in Splunk Enterprise Security 02-19-2020 0 4	0	4
How to upgrade splunk enterprise and enterprise security? I have to upgrade splunk enterprise (from 7.2.6 to 8.0.1 ) and enterprise security (from 5.3.0 to 6.0.0) I am followi... by imontanoisoft Explorer in Splunk Enterprise Security 02-19-2020 0 1	0	1
Splunk Enterprise security version 6 having issues Splunk Enterprise security version 6 having issues we get the errors in incident review with the SA-Threat Intelli... by RK_sp1unk New Member in Splunk Enterprise Security 02-19-2020 0 0	0	0
how to create incident from an triggered alert Hi, I'm trying to create a alert action to create a incident when any alert gets triggered. Whats the best way to a... by avni26 Explorer in Splunk Enterprise Security 02-19-2020 0 3	0	3
How to control Report time range I have some saved Splunk reports. I am calling these reports every hour by JAVA API call. If any hour due to some iss... by twh1 Communicator in Splunk Enterprise Security 02-18-2020 0 0	0	0
ERROR X509 - X509 certificate alternate namedid not match any allowed names Hi All, I have this issue that device is not logging to splunk. When I checked the splunkd.log I have found this err... by vdeomampo12 New Member in Splunk Enterprise Security 02-18-2020 0 0	0	0
Where to install Phantom Remote Search Does the Phantom Remote Search app get installed on my Enterprise Security Search Head, a HEC server, or another serv... by rtoloczk Explorer in Splunk Enterprise Security 02-18-2020 1 2	1	2
Free Courses for government personnel? Does Splunk offer any additional courses for government personnel? Kind Regards, Mike by mjjohnson3 New Member in Splunk Enterprise Security 02-18-2020 0 2	0	2
Splunk Enterprise Security Threat Intelligence does not have field "Organization" From my threat intel source, we tried to forward the intelligence source to Splunk ES-> Threat Intelligence The raw ... by tan_junyuan Engager in Splunk Enterprise Security 02-17-2020 0 0	0	0
Setup multiple layouts in ES incident review for various users How to customize the ES Incident Review in a way: 1) Once logged in, users can only see the Incident Review Dashboard... by sumchan Engager in Splunk Enterprise Security 02-17-2020 1 0	1	0
Universal Fowarder: Upgrade and switch to low privilege mode Hey All, We are planning on moving all of our UF's to the low priv mode install but I had a question. Our current U... by adalbor Builder in Splunk Enterprise Security 02-17-2020 0 2	0	2
Log Parsing is not happening for PaloAlto logs Palo Alto firewall device (IPS and IDS only) is sending logs to rsyslog server and it gets saved in a directory. The... by bsuresh1 Path Finder in Splunk Enterprise Security 02-15-2020 1 4	1	4
Need help with Configuring Splunk Add-on for Cisco ESA Hello All, I have been going through Multiple posts but still not able to configure my Splunk Add-on for Cisco ESA. ... by spodda01da Path Finder in Splunk Enterprise Security 02-14-2020 0 0	0	0
Problem integrating Infoblox in Splunk Good Morning, I am implementing Infoblox logs in Splunk and it is giving me problems. I have 3 Splunk machines, one ... by carlangas93 New Member in Splunk Enterprise Security 02-14-2020 0 0	0	0
Enterprise Security: Why is signature a recommended field according to the cim validator? The cim validator shows the signature field as a recommended field for the Authentication datamodel while the followi... by danielbb Motivator in Splunk Enterprise Security 02-12-2020 1 2	1	2
How do I send AWS GuardDuty Logs to Splunk? Hello all, I'm currently trying to send AWS GuardDuty logs to Splunk and am hoping someone here can help. I'm using... by cody_richardson Path Finder in Splunk Enterprise Security 02-12-2020 0 3	0	3
How to find root cause and solution for Unable to distribute to peer named xxxxxxxxxxxxx at uri= xxxxx Unable to distribute to peer named xxxxxx at uri=xxxxxxxx:8089 using the uri-scheme=https because peer has status=2. ... by alexspunkshell Contributor in Splunk Enterprise Security 02-12-2020 0 1	0	1
How to combine rows with overlapping MV values I have data from a couple different sources that I am trying to combine together into coherent results. The issue I a... by sonydrew Explorer in Splunk Enterprise Security 02-12-2020 0 8	0	8
Enterprise Security 6.x Multisite Search head Cluster Hi, Does anyone happen to know if Multisite search head clustering is suppported in ES 6.x? The validated architectu... by danan5 Path Finder in Splunk Enterprise Security 02-12-2020 0 1	0	1
Earliest and latest time URL parameter Hi, I have a scheduled search in Splunk with the following link in the description field [1] and would like to captur... by mteverest New Member in Splunk Enterprise Security 02-12-2020 0 3	0	3