Hi, I'm not sure if this is what you're asking about, but there's a doc on restoring based on internal audit logs:  https://docs.splunk.com/Documentation/ES/6.4.0/Install/InstallEnterpriseSecuritySHC#Restore_incident_review_history_from_internal_audit_logs ... View more

Splunk platform includes, for example: Splunk Enterprise, Splunk Cloud, etc.  Splunk apps include, for example: Splunk Enterprise Security, Splunk IT Service Intelligence, etc.  ... View more

If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset or identity, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  Upcoming versions have some features that might address your issue. You can disable the merge: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Globalsettings#Enable_merge_for_assets_or_identities You can put the duplicates in different entity zones: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Globalsettings#Enable_entity_zones_for_Assets_or_Identities You can change the key to a different field for the merge: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Assetsettings#Add_or_edit_an_asset_field  Take note of the following if/when you upgrade: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Manageassetsandidentititiesuponupgrade  ... View more

Which version of ES are you using? And are you mapping them in correlation searches or trying to map in a different way?  https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Configurecorrelationsearches#Use_security_framework_annotations_in_correlation_searches  ... View more

Did you try a search for index=notable & then see the source and sourcetype as selected fields or interesting fields in the results?   ... View more

Also the compatibility matrix:  https://docs.splunk.com/Documentation/VersionCompatibility/latest/Matrix/CompatMatrix ... View more

https://docs.splunk.com/Documentation/Splunk/8.0.5/Python3Migration/ES#Splunk_Enterprise_Security_version_6.0.x_and_Python_compatibility Has been updated: "Splunk Enterprise Security version 6.0.x is compatible with various versions of Splunk Enterprise 7.2.x through 8.0.x. The following flag is available in the ES 6.0.x specification files: python.version = {default|python|python2|python3} However, this release is not completely dual Python 2 and Python 3 compatible. In Splunk Enterprise 8.0, it requires the Python 2 interpreter that ships with 8.0. Various configuration files are set python.version = python2 on purpose. If using Splunk Enterprise 8.0, do not set the python.version flags to python3 or run in strict python3 mode at this time."   ... View more

Do the others have edit_timeline? They might need that one for being a collaborator. https://docs.splunk.com/Documentation/ES/6.2.0/Install/ConfigureUsersRoles#Capabilities_specific_to_Splunk_Enterprise_Security   ... View more

In 6.0 there's a new behavior that sounds like what you're looking for: "Leverage KV store as a new interface for Assets and Identities. Allow for extensible fields in the Assets and Identities table definition, as well as enhance scalability/performance so that customers with very large, csv-based lookup files can easily administer their ES environments with fewer bundle replication related issues." https://docs.splunk.com/Documentation/ES/6.0.0/RN/Enhancements (However, 6.1.1 is the latest release and 6.2.0 is just around the corner, so check em all before you decide on an upgrade path 🙂 ) ... View more

The Splunk Machine Learning Toolkit (MLTK) replaced Extreme Search: https://docs.splunk.com/Documentation/ES/6.1.1/Admin/MLTKoverview ... View more

https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/CompatMatrix ... View more

Is it in here? https://docs.splunk.com/Documentation/ES/6.1.1/Admin/Logfiles#app_permissions_manager.log ... View more

https://docs.splunk.com/Documentation/Splunk/Latest/Admin/StartSplunk Stop Splunk Enterprise To shut down Splunk Enterprise, run this command: splunk stop To stop splunkd and Splunk Web individually, type: splunk stop splunkd or (in legacy mode only) # splunk stop splunkweb ... View more

Depending on the app version, it might not be advisable to change it. Just as an example: https://docs.splunk.com/Documentation/Splunk/latest/Python3Migration/ES#Splunk_Enterprise_Security_version_6.1.x_and_Python_compatibility ... View more

https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallEnterpriseSecurity#Step_2._Install_Splunk_Enterprise_Security ... View more

Thanks! And the corresponding doc for where to find it: https://docs.splunk.com/Documentation/ES/6.0.0/Admin/Manageassetsandidentities#Use_the_search_preview_to_test_the_merge_process ... View more

I believe you can just upgrade directly from 7.0 to 7.2: https://docs.splunk.com/Documentation/Splunk/7.2.9/Installation/AboutupgradingREADTHISFIRST And then upgrade ES directly from 5.0 to 5.3: https://docs.splunk.com/Documentation/ES/5.3.1/Install/Beforeupgrading ... View more

Which version of ES? Maybe you could use MLTK. There's an example of filtering out the CIDR range of test servers by using .src!=10.11.36.0/24 : https://docs.splunk.com/Documentation/ES/6.0.0/Admin/MLTKoverview#Finding_outliers_with_DensityFunction ... View more

There are three types of add-ons for Enterprise Security: domain add-ons (DAs), supporting add-ons (SAs), and technology add-ons (TAs). For example: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/abouttheessolution What are you trying to do? ... View more

https://docs.splunk.com/Documentation/Splunk/8.0.1/ReleaseNotes/MeetSplunk#What.27s_New_in_8.0.1 ... View more

Would a field alias do the trick? https://docs.splunk.com/Documentation/CIM/4.14.0/User/UsetheCIMtonormalizeCPUperformancemetrics#Step_5._Make_fields_CIM-compliant_2 ... View more

I don't have the answer about when... but there will be a new version of ES. Keep an eye on the compatibility matrix: https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/CompatMatrix ... View more

Sounds like if your search has multivalue fields & you want them separated out, then you use it... https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Mvexpand "Expands the values of a multivalue field into separate events, one event for each value in the multivalue field. For each result, the mvexpand command creates a new result for every multivalue field." If you don't want them separated, then you don't. ... View more