Splunk Enterprise Security

Community Activity

When will Splunk Enterprise 8.0.1 be released? When will Splunk Enterprise 8.0.1 (version with timestamp fix) be available? What version of Splunk ES will be fully... by isbjorn Engager in Splunk Enterprise Security 12-13-2019 18 11	18	11
Is there an optimal version of RHEL 7.7 for installing Splunk? We are setting up Splunk in a secure environment, and we were wondering if anyone has come across an "optimal" or bas... by danny12345 Explorer in Splunk Enterprise Security 12-13-2019 0 4	0	4
Obtaining Weighted Values to Multiple Stats Queries Apologies as this one is smashing my head into a wall. I'm currently looking to obtain 3 values in the end: A regula... by giventofly08 Explorer in Splunk Enterprise Security 12-12-2019 0 1	0	1
Unable to View Notable when searching with event_id field We have a panel in ES App Security Posture dashboard which shows all the overdue notables. While clicking on each no... by anuremanan88 Explorer in Splunk Enterprise Security 12-12-2019 0 0	0	0
How to add Python librarys to Splunk with PyUnicode UCS4 I created an custom command with iocextract Python libray inside a new Splunk app. https://github.com/InQuest/python-... by calcometer Explorer in Splunk Enterprise Security 12-12-2019 0 0	0	0
CIDR Range to Match a SUB CIDR Range Hello All, I have two lookup tables that contain CIDR Ranges. One being a top level and the other one being the sub ... by ARobillard New Member in Splunk Enterprise Security 12-11-2019 0 4	0	4
Adaptive Response & Notable Race Condition We utilize adaptive response rules quite a bit within Splunk and have had quite a bit of success manually running the... by ericl42 Path Finder in Splunk Enterprise Security 12-11-2019 0 1	0	1
How to mix fields from two sourcetypes Hello, I have these two searches: sourcetype=pan:threat src IN (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) \| where ... by pacmac Explorer in Splunk Enterprise Security 12-11-2019 0 3	0	3
Errors after upgrading to Splunk ES 6.0 Hi, I've just upgraded to Splunk 6.0, but I have encountered some problems. Some of the dashbaords won't load anymor... by hettervik SplunkTrust in Splunk Enterprise Security 12-11-2019 0 1	0	1
How to pass data to an external api Hi, I am using a 3rd party tool to get information about different indicators of compromise (eg: domains). I am gett... by dkloud Explorer in Splunk Enterprise Security 12-10-2019 0 2	0	2
Should I build my integration for Splunk Enterprise or Splunk Enterprise Security? Hi Everyone, We are trying to develop an integration for Splunk based on our On-demand scanning APIs. We offer on-de... by umairahmad3985 Path Finder in Splunk Enterprise Security 12-10-2019 0 6	0	6
Why are some tokens not expanding in incident review even though the fields are present in the notable event? Splunk Version 7.3.2, ES Version 5.3.1 Post-upgrade a couple of our notables are displaying tokens in the notable ti... by dflodstrom Builder in Splunk Enterprise Security 12-09-2019 0 6	0	6
What is the best concept for enrichment from multiply columns through multiple indices within one SPL? I want to enrich my resultset from one SPL with multiply columns from other fields. I know map or joins can be used. ... by grobendg Explorer in Splunk Enterprise Security 12-09-2019 0 6	0	6
KV Store - audit trail? We're writing an app that allows users to input some asset lookup data into a KV Store. Occasionally these KV Store ... by driekhof Path Finder in Splunk Enterprise Security 12-07-2019 0 3	0	3
How to create an alias for a CIM field in Splunk ES? I am extracting the src and user values from failed login attempts in Shibboleth logs and the value is "failed" so I ... by jwalzerpitt Influencer in Splunk Enterprise Security 12-06-2019 0 4	0	4
How to roll back to using LDAP authentication? I'm testing out an SSO feature in Okta. I was initially using LDAP as the authentication method. There was a config... by Fleqx New Member in Splunk Enterprise Security 12-05-2019 0 0	0	0
corellation search for below scenerio \| tstats summariesonly max(time) as _time,values(Web.http_method) as http_method,values(Web.status) as status,count f... by vikram1583 Explorer in Splunk Enterprise Security 12-05-2019 0 2	0	2
How can splunk tell me if I have access to Palo Alto Hello, I am relatively new with splunk and would like to know how to run a query to tell if I have access to Palo alt... by cosmo360 New Member in Splunk Enterprise Security 12-05-2019 0 1	0	1
creating drilldown panel based on the selected value in $click.value$ I want to create a drilldown panel that will run different searches based on the value selected i.e. $click.value$. ... by ManishVilla7 Explorer in Splunk Enterprise Security 12-05-2019 0 3	0	3
Glass Table not loading in Splunk ES Hi folks, We have created a glass table in Splunk ES. It worked yesterday, but today when we try to open it, it does... by hettervik SplunkTrust in Splunk Enterprise Security 12-05-2019 0 3	0	3
Zscaler add-on field extraction Hi All, We receiving zscaler logs on syslog server from there forwarder is reading logs and sending to Splunk cloud.... by bhsakarchourasi Path Finder in Splunk Enterprise Security 12-04-2019 0 0	0	0
splunk search query Hi suppose I have this IP address 10.5.5.5 I just want to see any information that splunk has on this IP. I'm star... by trojan_81 Path Finder in Splunk Enterprise Security 12-03-2019 0 1	0	1
Check for users clicking on a totally new url in last 24 hrs I need to search for users who clicked on totally new urls seen in last 24 hrs. If user has clicked on a link which ... by abhik1501 New Member in Splunk Enterprise Security 12-03-2019 0 4	0	4
Question about improvments regarding IoC in Threat Intel collection Hello All on Forum I have following problem with threat intel in Splunk ES. I have got IoC, which is IP address and ... by d4wc3k Path Finder in Splunk Enterprise Security 12-03-2019 0 0	0	0
intelligence lookup source is not working Hi, I have a intelligence lookup file in SA-ThreatIntelligence APP. This lookup schedule content update with open so... by osmandemir1 New Member in Splunk Enterprise Security 12-03-2019 0 0	0	0