I presume, you are referring to Enterprise Security App. You may click notable event, then click arrow on far left. You will get below details including event_id, event_hash, domain, urgency etc. Description: The system 10.11.36.20 has failed sshd authentication 44 times using 38 username(s) against 1 target(s) in the last hour Additional Fields Value Action Application sshd Source 10.11.36.20 Source Business Unit americas Source Category pci splunk Source City Pleasanton Source Country USA Source IP Address 10.11.36.20 Source Expected true Source Latitude 37.694452 Source Longitude -121.894461 Source Owner Bill_williams Source PCI Domain trust Source Requires Antivirus false Source Should Time Synchronize true Source Should Update true Correlation Search: Access - Excessive Failed Logins - Rule History: View all review activity for this Notable Event Contributing Events: View all login failures by system 10.11.36.20 for the application sshd Event Details: event_id es1-ap.demo.splunk.com@@notable@@d3a7697a3a20234151c5ab8669716857 event_hash d3a7697a3a20234151c5ab8669716857 eventtype nix-all-logs suppress_src notable A notable event is a Splunk term. Whenever underlying correlation search comes positive, it will generate a notable event. You can see correlation search that triggered notable event. ... View more

You can push precise config to pull data from UF & change config whenever you want to stop it using DS. But this is not a recommended approach as all data could be used for operational intelligence. If you filter data, you may not achieve desired results. ... View more

Please try Splunk App for Windows Infra (https://apps.splunk.com/app/1680/). It has prebuilt dashboards for AD environment. ... View more

Can't you use DB connect? ... View more

Please refer to this link http://docs.splunk.com/Documentation/Splunk/6.1.2/Security/Turnonbasicencryptionusingweb.conf ... View more

Just to add, you can also adjust polling interval to 1hour or more assuming you won't change config frequently. So that your DS can manage at least 2K forwarders. ... View more

If your query is still open, you may use below - [monitor://G:\opdata\my_data\motherfolder\] whitelist = \d{6}\*sunn.txt ... View more

Did you get a chance to look at this https://apps.splunk.com/app/1808/. This add-on can certainly help you to extract data & create cool reports. You amy also look at Cisco Security Suite https://apps.splunk.com/app/525/. ... View more

Does it mean that you want to drop data after hot bucket reaches 3GB? ... View more

Hi - Here is definition of maxDataSize - maxDataSize = <positive integer>|auto|auto_high_volume * The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Docs link - http://docs.splunk.com/Documentation/Splunk/6.2.2/admin/Indexesconf In case you want to limit indexing volume/day, you should ideally configure inputs.conf for the correct inputs or props.conf for event filtering. ... View more

"your source" | rex "(?P<Email>\w+.\w+@\w+.\w+)" | rex "details (?P<Name>\w+)" | rex "(?<User_ID>\d{9})" | stats count by Name, Email, User_ID | Head 20 ... View more

You can certainly create a form in a dashboard that allows users to provide inputs e.g id, username, email id, time range etc. This can be done in core Splunk. Please refer to below doc link http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/FormEditor I don't have answer for 2nd & 3rd question. But you can definitely refer to http://dev.splunk.com/java for more information. ... View more

Could you please give a use cases/example that explains your query in detail. ... View more

Please try this "your source" | rex "(?P<Email>\w+.\w+@\w+.\w+)" | rex "details (?P<Name>\w+)" | stats count by Name, Email | Head 20 ... View more

could you please try below [monitor://G:\opdata\my_data\motherfolder\] whitelist = \d+\*sunn.txt ... View more

Search query depends upon the nature of data & what you would like to interpret from that. Few customers are pulling ticketing information, few are pulling performance counters. Hence there is no definite answer to your question. But search processing language remains the same e.g. stats, chart, eval, timechart etc. ... View more

Did you use backslash before w? ... View more

Please append w with slash. ... View more

Hi - Hope you have followed below link - http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Monitornetworkports ... View more

I presume you have followed Splunk doc for setting up Cisco IPS as data source. http://docs.splunk.com/Documentation/AddOns/released/CiscoIPS/Configureinputs If you still face any problem, please share inputs.conf, output of index=_internal tcpoutputproc error *.py ... View more

Hi - could you please make Alert Type=Real Time while saving an alert and see the result. ... View more

Please refer to below link - https://apps.splunk.com/app/1274/#/documentation ... View more