Splunk Enterprise Security

Community Activity

Do we have option in Splunk enterprise security to check the command output We created Dashboard in Splunk enterprise security where we can see the commands status and risk score for those comm... by sahiltcs Path Finder in Splunk Enterprise Security 02-25-2019 0 8	0	8
how do i monitor network data using netflow analyzer ? hello, how do i monitor network data using netflow analyzer? i have installed add on of netflow analyzer.please tell ... by rajpingale123 Engager in Splunk Enterprise Security 02-22-2019 0 1	0	1
In Splunk Enterprise Security, how do you access granular audit trails for user and role changes? I was looking for a way to view WHAT exactly was audited when someone changes a ROLE or USER (capabilities, inherited... by MatthewH007 Path Finder in Splunk Enterprise Security 02-22-2019 2 0	2	0
How to write a Splunk alert to find malicious C2 traffic using Cisco IPS logs Guys, Any idea of writing a splunk query to find the malicious command and control traffic using Cisco IPS logs. We ... by sivasankarketin New Member in Splunk Enterprise Security 02-22-2019 0 2	0	2
With Splunk Enterprise Security, I'm getting varying IP geo-location results when comparing Splunk to third-party resources — how frequent are Splunk geo cache updates? Hi, I'm getting varied results in Splunk when I investigate an IP address' location. Splunk might say "Netherlands",... by crumblecat88 Engager in Splunk Enterprise Security 02-22-2019 0 1	0	1
no expected fields in sourcetype Hello all! resently i downloaded Check Point App for Splunk. I configured in input.conf in order to force all Chech... by infosec_kicb New Member in Splunk Enterprise Security 02-22-2019 0 4	0	4
How to create Enterprise Security custom roles and have Notables dashboard different for each roles? hi anyone created "custom" roles in Enterprise Security and re-used the notables dashboard (security events) ? We ha... by koshyk Super Champion in Splunk Enterprise Security 02-22-2019 0 3	0	3
How do you pass the same token for two panels with one drop-down input? I want to pass a token from one panel to another panel. I mean, if I give one input in the drop down, it has to updat... by bhaskarasplunk Explorer in Splunk Enterprise Security 02-21-2019 0 2	0	2
Symantec MSS integration with Splunk for orchestration and Incident Management Dear ALL , I am searching a procedure to pull and update the incidents from Symantec MSS created by their SOC they... by sonin New Member in Splunk Enterprise Security 02-20-2019 0 0	0	0
Nessus Home and Splunk Add-On for Tenable Does this TA Support Nessus Home installations? I've tried to use Tenable.io and authentication seems to work but no... by tmiller_splunk Splunk Employee in Splunk Enterprise Security 02-19-2019 0 2	0	2
In Splunk Enterprise Security, how do you combine two searches into one query and group on a specific field? I am trying to create a query where there are two different searches that each produce a point in time for each devic... by iomega311 Explorer in Splunk Enterprise Security 02-19-2019 0 2	0	2
Fortigate logs are not in CIM format I installed Fortinet Fortigate Add-on for Splunk 1.6.0 and Fortinet Fortigate App for Splunk 1.4. Sourcetypes are ide... by map000 New Member in Splunk Enterprise Security 02-18-2019 0 3	0	3
Notable Event Urgency issues I have setup a few correlated events which currently are showing up in the incident review console as urgency (unknow... by 04cjm Engager in Splunk Enterprise Security 02-14-2019 1 3	1	3
Multiple tstats with prestats append=t not working in ES app Hi, I'm querying a datamodel X and I need to append results with same fields names from datamodel xx using. I'm try... by vj8210 Explorer in Splunk Enterprise Security 02-13-2019 1 2	1	2
Splunk Enterprise Security Alexa Domain NOT lookup failing Hello, I am trying to create alerts for all outbound DNS queries which do not match the top one million domains as p... by HannanPervez Explorer in Splunk Enterprise Security 02-13-2019 0 5	0	5
Threat Intelligence by default, where from threat Intelligence feed downloaded in splunk ? by godawatnikunj19 New Member in Splunk Enterprise Security 02-12-2019 0 1	0	1
Splunk Enterprise Security - Host Sending Excessive Emails Alert / Email Data model Hi Everyone I'm having trouble with one of the alerts in Enterprise Security which is causing a lot of noise and fal... by kamoenix New Member in Splunk Enterprise Security 02-11-2019 0 3	0	3
Subsearch relative to base search time Hello, I'm looking into a way to discover following scenario in my ingested logs: some user logged out and didn't lo... by hoytn Explorer in Splunk Enterprise Security 02-11-2019 0 2	0	2
Script exited abnormally with code 114 I'm getting a scripting error on our Enterprise Security server every hour: msg="A script exited abnormally" input="... by lball Explorer in Splunk Enterprise Security 02-11-2019 0 3	0	3
In Splunk Enterprise Security, how do you use a subsearch to correlate information? Hello, I'm trying to correlate events from 2 different source types, and 2 searches for example: sourcetypeA has fi... by lth186 New Member in Splunk Enterprise Security 02-10-2019 0 8	0	8
In Splunk Enterprise Security, how does Javascript SDK work? I wanna use client side SDK Hi, Thanks for coming to my question. I am having trouble using javascript SDK. I cannot understand what is "my s... by apple143 Engager in Splunk Enterprise Security 02-09-2019 0 0	0	0
Notable event missing from Incident Review dashboard? I have a search in which is generating results when I have it set as an alert and is successfully creating and event ... by arlombar Explorer in Splunk Enterprise Security 02-08-2019 0 4	0	4
Using a different email address to send email responses using adaptive response action Hi All, I have a use case where I want to send replies using a separate email address than the default address of Sp... by shiv1593 Communicator in Splunk Enterprise Security 02-08-2019 0 13	0	13
In the Lookup File Editor App, can you help me with the lookup permissions? Hi, When having lookups contained within an app, is it possible to set user permissions at the 'app' level as oppose... by jacqu3sy Path Finder in Splunk Enterprise Security 02-07-2019 0 2	0	2
How do I add macros into my search? Would any one know how to look up the name of a person who owns a notable event using the owner field? This is my sea... by wrosadj New Member in Splunk Enterprise Security 02-07-2019 0 2	0	2

Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Splunk Enterprise Security

Do we have option in Splunk enterprise security to check the command output

how do i monitor network data using netflow analyzer ?

In Splunk Enterprise Security, how do you access granular audit trails for user and role changes?

How to write a Splunk alert to find malicious C2 traffic using Cisco IPS logs

With Splunk Enterprise Security, I'm getting varying IP geo-location results when comparing Splunk to third-party resources — how frequent are Splunk geo cache updates?

no expected fields in sourcetype

How to create Enterprise Security custom roles and have Notables dashboard different for each roles?

How do you pass the same token for two panels with one drop-down input?

Symantec MSS integration with Splunk for orchestration and Incident Management

Nessus Home and Splunk Add-On for Tenable

In Splunk Enterprise Security, how do you combine two searches into one query and group on a specific field?

Fortigate logs are not in CIM format

Notable Event Urgency issues

Multiple tstats with prestats append=t not working in ES app

Splunk Enterprise Security Alexa Domain NOT lookup failing

Threat Intelligence

Splunk Enterprise Security - Host Sending Excessive Emails Alert / Email Data model

Subsearch relative to base search time

Script exited abnormally with code 114

In Splunk Enterprise Security, how do you use a subsearch to correlate information?

In Splunk Enterprise Security, how does Javascript SDK work? I wanna use client side SDK

Notable event missing from Incident Review dashboard?

Using a different email address to send email responses using adaptive response action

In the Lookup File Editor App, can you help me with the lookup permissions?

How do I add macros into my search?

AI for AppInspect

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Delay Sending Threats from Splunk ES to Splunk SOA...

Upgrading from ES 7 to 8

Disposition CHart

How to handle Defender Incidents/Alerts with ES No...

Splunk Enterprise Security API support for update ...

Splunk Enterprise Security

Join the Conversation