Hi @Narendra045  Drilldown might help your case - https://docs.splunk.com/Documentation/Splunk/8.2.3/Viz/PanelreferenceforSimplifiedXML#drilldown At a high-level set a token and use that $token_name$ as depends= in another panel. -- An upvote would be appreciated if this reply helps! ... View more

Hi @noott211  What do you mean by you couldn't call it up? The above query should work just fine if the index=error_ip_count exist on indexers otherwise you need to create it. --- An upvote would be appreciated if this reply helps! ... View more

Hi @dhotlosz  Go to if linux  - /opt/splunk/etc/apps/splunk_archiver/default open savedsearches.conf, find [Bucket Copy Trigger] add disabled = 1. --- An upvote would be appreciated if this reply helps! ... View more

Hi @VijaySrrie  You should probably rely on syslog  /Splunk TCP/UDP.  This add-on assumes you are onboarding the data either using a syslog collector that outputs to a file or using the built-in Splunk TCP/UDP listener (I would highly recommend the former) read here - https://splunkbase.splunk.com/app/5278/ -- An upvote would be appreciated if this reply helps! ... View more

Hi @VijaySrrie  Read this the description talk about MCAS however this doesn't do ingest them just for CIM - https://splunkbase.splunk.com/app/5278/ MCAS logs you would probably need syslog/ Splunk TCP/UDP to ingest.  Microsoft 365 Defender add-on as per the docs it ingest only Incidents & Alerts. --- An upvote would be appreciated if this reply helps! ... View more

Hi @teresachila  Threat intel supports POST you could check here - https://docs.splunk.com/Documentation/ES/6.6.2/Admin/Downloadthreatfeed The formats JSON seems not supported yet- this is the old post however still a good alternative solution for JSON -> https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Is-there-a-way-to-accept-JSON-as-a/m-p/220299 The above said url expects POST method, without POST arguments threat intel inputs might be assuming as GET method.  { "query_status": "http_post_expected", "data": "The API expects a HTTP POST request" } --- An upvote would be appreciated if this reply helps!   ... View more

Hi @SamHTexas  Have you gone through the add-on available here - https://splunkbase.splunk.com/app/2648/#/overview To suite your needs. -- An upvote would be appreciated if this reply helps! ... View more

Hi @dconverse  You could track the status here and find relevant info for your products in use. https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228.html --- An upvote would be appreciated if this reply helps! ... View more

There is no receiving Email functionality. The solution you are after is to hook the SMTP outbound to Splunk Incoming/Ingestion layer there is no such solution exist in Splunk out-of-the box or Splunkbase.   ... View more

Hi @phamxuantung  Without boundaries pre-defined set of chars ahead or delimiter or pattern its tough to extract. For rex the user has to give an indication from where to start extracting and where to end boundaries..  ... View more

Hi @phamxuantung  IF you schedule an alert between 11 PM and 6 AM to run you can not differ the email to sent out at 08 AM. Instead you could schedule the alert at above said time write the results to a summary index or lookup. At 08 AM you should schedule one more alert for Email Action alone looking into results either summary index or lookup file. You will end up having 2 scheduled searches. ... View more

Hi @DanAlexander  Following is the lookup maintains the state of notables having status ( numbers ) and comments. You could filter based on comments and findout them and update lookup back to the status you wish to. Should be very careful have a backup before! | inputlookup incident_review_lookup From UI you could try -> try filter by providing the notes/comments you have provided and Urgency to closed. Should filter all the notables that have been modified. Then 'Edit selected' and update the status.. etc or comments. I haven't tried myself these options be cautious and having enough backup to restore. ... View more

@kiranpanchavat1  Haven't worked with SQL Server though this is purely driver compatibility/ SSL compability issues between driver / SQL Server. did you check other forums specific to this JDBC  issue? https://social.technet.microsoft.com/Forums/en-US/07ca9eec-a092-436e-b960-3fe15bc36389/unable-to-open-connection-to-sql-server?forum=sqlsecurity Lower the TLS version and try and read the SQL Server version docs to find the suitable driver. You might need to replace the driver of DB-Connect if the latest version of JDBC driver do not support old SQL server version. -- an upvote would be appreciated if this reply helps ! ... View more

What do you mean by PL/SQL script  / which DB ? the DB could be anything as long as DBConnect supports it. ... View more

should know what's been compared and either extract using rex or other functions like split, substring. Pattern is must generic solution is tough without knowing how the data is structured. ... View more

Hi @rameshsplk  The app is dev supported - Splunk for Excel Export | Splunkbase Not much info on it, the developer might help with the issue. It might not compatible with latest 8.x version!! ... View more

Hi @altink  This link would help - https://docs.splunk.com/Documentation/DBX/3.6.0/DeployDBX/Commands   ... View more

<your_base> | transpose | rename "row 1" as number ... View more

Hi @rameshsplk  Check the splunk_web logs to find the reason for 404.   index=_internal sourcetype=splunk_web* ERROR OR WARN <your_app_name>       ... View more

@kiranpanchavat1 if you resolved it post solution that would help other users. ... View more