Hi @abi2023 , It is not so clear to me if you want to apply color to the cells in the "user" column only if in a specific format and shape, so if you can clarify it would be nice. You can apply that to the table section in your XML code by adding the Format tag with type color. Under that, you specify the type of coloring logic that can be dynamic, range, scale, etc... For example, for a rule that will color the cells of User column whenever there is a value with a light green cell color: <format type="color" field="user"> <colorPalette type="expression">if (isnotnull(value), "#00ff3c", "#f24949") </colorPalette> </format> Green will be valid values, red will be empty/null value cells. Is something like that you're looking for? Full sample: <dashboard version="1.1" theme="dark"> <label>My Dashboard</label> <row> <panel> <table> <search> <query>MySearchString</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="user"> <colorPalette type="expression">if (isnotnull(value), "#00ff3c", "#f24949") </colorPalette> </format> </table> </panel> </row> </dashboard>   ... View more

Hi @darkins , It is actually simple, as long as you are comfortable with regex syntax. It will be like this: | eval condition=case(match(_raw, "thisword"), "first_condition", match(_raw, "thisotherword"), "second_condition", 1=1,"default_condition") | rex field=_raw "<rex_pattern>" if condition=="first_condition" | rex field=_raw "<rex_pattern>" if condition=="second_condition" | rex field=_raw "<rex_pattern>" if condition=="default_condition" Give it a try and let me know how it goes. ... View more

Hey @tread_splunk , Not gonna lie, it seems a bit confuse to understand your goal here. Both actions search and GET_PASSWORD only resides in _audit index, while internal index will have other kind of information. IF what you want is just use the internal logs to get the source clientip for that user (not exactly related to the action calls though) you can try something like this: index=_audit (action=search OR action=GET_PASSWORD) | stats count as audit_count by user | join user [ search index=_internal sourcetype=splunkd_access user=* clientip=* | stats count as internal_count by user clientip] | table user clientip audit_count internal_count The counts on audit and internal is the part that doesn't make much sense to me unless you want to filter the URI in the internal logs to something that is triggered during action=search or action=GET_PASSWORD, so you can customize my query a bit more. If I'm tripping, please help me understanding your goal so I can try to give you more insights if any. ... View more

Yep, you'll have to have separated calls for that. Filters on SOAR REST can be appended but they will work as "AND" condition as "OR" is not supported in that sense as a limitation on Django querysets 😞 So the easiest way would be to combine the results of https://<your_soar_instance>/rest/container?_filter_name__icontains="computer" and the ones from https://<your_soar_instance>/rest/container?_filter_name__icontains="process" and finally process then accordingly.   ... View more

Hey @meshorer ,   Have you tried to ssh to your Phantom/SOAR server and run this? phenv set_preference --indicators yes This should be enough to reenable the indicators for you. Once executed please allow it up to 5 minutes for the system to start the indicators again. ... View more

Awesome! Glad to know that. Please remember to mark this as resolved so others can know about it. Happy splunking! ... View more

A quick win will be tagging the container. You can edit your playbook to check if the tag of the container is XYZ, which will be not in the first run (for the first artifact). Once you call your action to create an incident, change the tag of the container to XYZ, so even if the next artifact triggers the playbook, the tag will already by XYZ and the create incident action will not be called as it will not satisfy your condition. While creating artifacts manually (via rest, for example), you can force the parameter "run_automation" to false, preventing that new artifact to trigger the playbook execution, but in your case data is coming from the export app so maybe you can find some settings in there to change this behavior (honestly I don't recall one, but maybe you can find something interesting) ... View more

Your props is not matching the stanza name of transforms. Not sure if that was a typo... About a typo, you don't need that first pipe in the ingest_eval. Try this instead (I changed the regex a bit) Props.conf: [your_sourcetype] TRANSFORMS-set_time = set_time_from_file_path Transforms.conf [set_time_from_file_path] INGEST_EVAL = eval _time = strptime(replace(source, ".*/ute-(\\d{4}-\\d{2}-\\d{2}[a-z]+)/([^/]+/[^/]+).*","\\1"), "%Y-%m-%d_%H-%M-%S") ... View more

Hey Ricky, AFAIK maxWarmDBCount doesn't affect the rollover of data (but it can be storage hungry so be careful with that), it is something the frozenTimePeriodInSecs do instead. In your case, if I understood correctly, the frozen time already passed but your data did not rolled over, and that may be either because your cluster manager is too busy at the moment (and you are experiencing delay in this processing) OR maybe it is waiting for the buckets to hit a threshold in size. Check the bucket replication status also, it may indicate if there is any problem in there... Are you using maxTotalDataSizeMB key by any chance? Try to add that also to see if you get any diff behavior. ... View more

I have this integration working on my environment and it works like a charm! Just keep in mind that the user you configure in the add-on to be used in this integration must have access to ServiceNow to read/write the proper tables that you want to interface (events, incidents, etc). In my case, our API users that are given by ServiceNow don't have access to the UI for security purposes, so I wasn't able to make the configuration via Add-On UI as it returns HTTP 400 status, but if you do the configuration via conf file it goes just fine. Today I use this add-on to ingest data from ServiceNow to Splunk (incidents, requests, changes, cmdb) and also to create incidents on ServiceNow from Splunk alerts via alert action. ... View more

Not really. That's just an overall count of ingested events. I'm looking more at the DB level because I suspect that there is something "stuck" in DB side, so something like table sizes and etc. ... View more

Try to create a child playbook that has a custom function and then the SNOW app ahead of it. So you can call this child playbook passing only the fields that can be dynamic, and the child playbook will append those to the hard coded fields (like your Incident Category) and then pass those to the SNOW app action that you want to call. Have you explored that option? ... View more

Hey @dbkuhn , There is any change of sharing this query?  Also, how did you cleaned up this indicator you mentioned? I tried to do the cleanup via delete_containers.py and when I started vacuum process if filled up the disk as it needs kinda of the same amount of data to dispose in disk to process, so it was worse than I thought and now my dev environment is down with 20kb free space in the mount. I'll have to struggle here to try to expand the mount first in order to be able to re-start the db and start the vacuum again. ... View more

Hey @ouss , Sorry to revive this but did you find anything? I'm going thru the same situation here, no luck on finding answers yet. ... View more

It looks like you're sending HTML emails and that black diamont is basically charset mismatch between source and destination (the string send to the body VS the email server I mean), so in those emails you have that character displayed, that means the playbook got a string that has special encoded characters on that and it don't match the expected encoding from your mail server. If you don't need HTML, just send it as text (send rawemail action). If you do need HTML emails (send htmlemail action), try to change the encoding asset configuration flag to true/false depending if you are using unicode characters or not. Finally you can also add the charset at the header of your HTML message body if you are for sure using HTML code in text. Check that and see if you have any different behavior ... View more

Thanks @hariomenkel. Works like a charm! ... View more