@isoutamo  The method you suggest, I don't mind if you don't tell me how many bytes or Gygabytes were transferred, but it would help me if you alert me if there is abnormal traffic from one host to another. I need to prevent possible information leakage When you talk about event count, do you mean the number of events from one host to another? If so, I would appreciate how the query would be.   thank you ... View more

thanks for your help ... View more

@isoutamo  these are the jobs that I see in real time 317 results with this query 😅 | rest splunk_server=local /servicesNS/-/-/saved/searches | search is_scheduled=1 disabled=0 | fields dispatch.earliest_time dispatch.latest_time eai:acl.owner eai:acl.sharing search cron_schedule title | rename dispatch.earliest_time as earliest_time, dispatch.latest_time as latest_time, eai:acl.owner as owner, eai:acl.sharing as sharing | table title cron_schedule earliest_time latest_time schedule_window owner sharing cron_schedule 0 * * * * = 149 title cron_schedule Audit - Script Errors 0 * * * * Endpoint - High Number Of Infected Hosts - Rule 0 * * * * Endpoint - Update Signature Reference - Lookup Gen 0 * * * * ESCU - Access LSASS Memory for Dump Creation - Rule 0 * * * * ESCU - Attempt To Add Certificate To Untrusted Store - Rule 0 * * * * ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule 0 * * * * ESCU - Attempt To Stop Security Service - Rule 0 * * * * ESCU - Attempted Credential Dump From Registry via Reg exe - Rule 0 * * * * ESCU - Batch File Write to System32 - Rule 0 * * * * ESCU - Child Processes of Spoolsv exe - Rule 0 * * * * ESCU - Clients Connecting to Multiple DNS Servers - Rule 0 * * * * ESCU - Common Ransomware Extensions - Rule 0 * * * * ESCU - Common Ransomware Notes - Rule 0 * * * * ESCU - Create local admin accounts using net exe - Rule 0 * * * * ESCU - Create or delete windows shares using net exe - Rule 0 * * * * ESCU - Create Remote Thread into LSASS - Rule 0 * * * * ESCU - Creation of Shadow Copy - Rule 0 * * * * ESCU - Creation of Shadow Copy with wmic and powershell - Rule 0 * * * * ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule 0 * * * * ESCU - Credential Dumping via Symlink to Shadow Copy - Rule 0 * * * * ESCU - Deleting Shadow Copies - Rule 0 * * * * ESCU - Detect Activity Related to Pass the Hash Attacks - Rule 0 * * * * ESCU - Detect API activity from users without MFA - Rule 0 * * * * ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule 0 * * * * ESCU - Detect Credential Dumping through LSASS access - Rule 0 * * * * ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule 0 * * * * ESCU - Detect Excessive Account Lockouts From Endpoint - Rule 0 * * * * ESCU - Detect Excessive User Account Lockouts - Rule 0 * * * * ESCU - Detect hosts connecting to dynamic domain providers - Rule 0 * * * * ESCU - Detect Long DNS TXT Record Response - Rule 0 * * * * ESCU - Detect malicious requests to exploit JBoss servers - Rule 0 * * * * ESCU - Detect Mimikatz Using Loaded Images - Rule 0 * * * * ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule 0 * * * * ESCU - Detect mshta exe running scripts in command-line arguments - Rule 0 * * * * ESCU - Detect new API calls from user roles - Rule 0 * * * * ESCU - Detect New Local Admin account - Rule 0 * * * * ESCU - Detect New Login Attempts to Routers - Rule 0 * * * * ESCU - Detect New Open S3 buckets - Rule 0 * * * * ESCU - Detect Oulook exe writing a  zip file - Rule 0 * * * * ESCU - Detect Path Interception By Creation Of program exe - Rule 0 * * * * ESCU - Detect processes used for System Network Configuration Discovery - Rule 0 * * * * ESCU - Detect Prohibited Applications Spawning cmd exe - Rule 0 * * * * ESCU - Detect PsExec With accepteula Flag - Rule 0 * * * * ESCU - Detect S3 access from a new IP - Rule 0 * * * * ESCU - Detect Spike in Network ACL Activity - Rule 0 * * * * ESCU - Detect Spike in S3 Bucket deletion - Rule 0 * * * * ESCU - Detect Spike in Security Group Activity - Rule 0 * * * * ESCU - Detect Unauthorized Assets by MAC address - Rule 0 * * * * ESCU - Detect USB device insertion - Rule 0 * * * * ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule 0 * * * * ESCU - Detect web traffic to dynamic domain providers - Rule 0 * * * * ESCU - Detection of DNS Tunnels - Rule 0 * * * * ESCU - Detection of tools built by NirSoft - Rule 0 * * * * ESCU - Disabling Remote User Account Control - Rule 0 * * * * ESCU - DNS Query Length Outliers - MLTK - Rule 0 * * * * ESCU - DNS Query Length With High Standard Deviation - Rule 0 * * * * ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule 0 * * * * ESCU - DNS record changed - Rule 0 * * * * ESCU - Dump LSASS via comsvcs DLL - Rule 0 * * * * ESCU - Email Attachments With Lots Of Spaces - Rule 0 * * * * ESCU - Email files written outside of the Outlook directory - Rule 0 * * * * ESCU - Email servers sending high volume traffic to hosts - Rule 0 * * * * ESCU - Excessive DNS Failures - Rule 0 * * * * ESCU - Execution of File with Multiple Extensions - Rule 0 * * * * ESCU - Execution of File With Spaces Before Extension - Rule 0 * * * * ESCU - Extended Period Without Successful Netbackup Backups - Rule 0 * * * * ESCU - File with Samsam Extension - Rule 0 * * * * ESCU - First Time Seen Child Process of Zoom - Rule 0 * * * * ESCU - First time seen command line argument - Rule 0 * * * * ESCU - First Time Seen Running Windows Service - Rule 0 * * * * ESCU - GCP GCR container uploaded - Rule 0 * * * * ESCU - GCP Kubernetes cluster scan detection - Rule 0 * * * * ESCU - Hiding Files And Directories With Attrib exe - Rule 0 * * * * ESCU - Hosts receiving high volume of network traffic from email server - Rule 0 * * * * ESCU - Identify New User Accounts - Rule 0 * * * * ESCU - Kerberoasting spn request with RC4 encryption - Rule 0 * * * * ESCU - Large Volume of DNS ANY Queries - Rule 0 * * * * ESCU - MacOS - Re-opened Applications - Rule 0 * * * * ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule 0 * * * * ESCU - Malicious PowerShell Process - Encoded Command - Rule 0 * * * * ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule 0 * * * * ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule 0 * * * * ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule 0 * * * * ESCU - Monitor DNS For Brand Abuse - Rule 0 * * * * ESCU - Monitor Email For Brand Abuse - Rule 0 * * * * ESCU - Monitor Registry Keys for Print Monitors - Rule 0 * * * * ESCU - Monitor Web Traffic For Brand Abuse - Rule 0 * * * * ESCU - No Windows Updates in a time frame - Rule 0 * * * * ESCU - Open Redirect in Splunk Web - Rule 0 * * * * ESCU - Osquery pack - ColdRoot detection - Rule 0 * * * * ESCU - Overwriting Accessibility Binaries - Rule 0 * * * * ESCU - Process Execution via WMI - Rule 0 * * * * ESCU - Processes created by netsh - Rule 0 * * * * ESCU - Processes launching netsh - Rule 0 * * * * ESCU - Processes Tapping Keyboard Events - Rule 0 * * * * ESCU - Prohibited Network Traffic Allowed - Rule 0 * * * * ESCU - Prohibited Software On Endpoint - Rule 0 * * * * ESCU - Protocol or Port Mismatch - Rule 0 * * * * ESCU - Protocols passing authentication in cleartext - Rule 0 * * * * ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule 0 * * * * ESCU - Reg exe used to hide files directories via registry keys - Rule 0 * * * * ESCU - Registry Keys for Creating SHIM Databases - Rule 0 * * * * ESCU - Registry Keys Used For Persistence - Rule 0 * * * * ESCU - Registry Keys Used For Privilege Escalation - Rule 0 * * * * ESCU - Remote Desktop Network Bruteforce - Rule 0 * * * * ESCU - Remote Desktop Network Traffic - Rule 0 * * * * ESCU - Remote Desktop Process Running On System - Rule 0 * * * * ESCU - Remote Process Instantiation via WMI - Rule 0 * * * * ESCU - Remote Registry Key modifications - Rule 0 * * * * ESCU - Remote WMI Command Attempt - Rule 0 * * * * ESCU - RunDLL Loading DLL By Ordinal - Rule 0 * * * * ESCU - Samsam Test File Write - Rule 0 * * * * ESCU - Sc exe Manipulating Windows Services - Rule 0 * * * * ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule 0 * * * * ESCU - Scheduled tasks used in BadRabbit ransomware - Rule 0 * * * * ESCU - Schtasks scheduling job on remote system - Rule 0 * * * * ESCU - Schtasks used for forcing a reboot - Rule 0 * * * * ESCU - Script Execution via WMI - Rule 0 * * * * ESCU - Shim Database File Creation - Rule 0 * * * * ESCU - Shim Database Installation With Suspicious Parameters - Rule 0 * * * * ESCU - Short Lived Windows Accounts - Rule 0 * * * * ESCU - Single Letter Process On Endpoint - Rule 0 * * * * ESCU - SMB Traffic Spike - MLTK - Rule 0 * * * * ESCU - SMB Traffic Spike - Rule 0 * * * * ESCU - Spectre and Meltdown Vulnerable Systems - Rule 0 * * * * ESCU - Spike in File Writes - Rule 0 * * * * ESCU - SQL Injection with Long URLs - Rule 0 * * * * ESCU - Suspicious Changes to File Associations - Rule 0 * * * * ESCU - Suspicious Email - UBA Anomaly - Rule 0 * * * * ESCU - Suspicious Email Attachment Extensions - Rule 0 * * * * ESCU - Suspicious File Write - Rule 0 * * * * ESCU - Suspicious LNK file launching a process - Rule 0 * * * * ESCU - Suspicious wevtutil Usage - Rule 0 * * * * ESCU - System Processes Run From Unexpected Locations - Rule 0 * * * * ESCU - TOR Traffic - Rule 0 * * * * ESCU - Uncommon Processes On Endpoint - Rule 0 * * * * ESCU - Unload Sysmon Filter Driver - Rule 0 * * * * ESCU - Unusually Long Command Line - MLTK - Rule 0 * * * * ESCU - Unusually Long Command Line - Rule 0 * * * * ESCU - USN Journal Deletion - Rule 0 * * * * ESCU - Web Fraud - Password Sharing Across Accounts - Rule 0 * * * * ESCU - Web Servers Executing Suspicious Processes - Rule 0 * * * * ESCU - Windows Event Log Cleared - Rule 0 * * * * ESCU - Windows hosts file modification - Rule 0 * * * * ESCU - WMI Permanent Event Subscription - Rule 0 * * * * ESCU - WMI Permanent Event Subscription - Sysmon - Rule 0 * * * * ESCU - WMI Temporary Event Subscription - Rule 0 * * * * Threat - Refresh Governance - Administrative 0 * * * * Threat - Refresh Reviewstatuses - Administrative 0 * * * * ... View more

Because I cannot see IOPS in the Monitor Console, I did the validation directly from linux with the command iotop -o Splunk Enterprise Security =High use of IOPS Indexer = High use of IOPS indexer2  = High use of IOPS HF = Low use HF = Low use I see that the server is a virtual machine, should I request that IOPS be increased in WM?     ... View more

@Nisha18789 I see that by default it is in this way /splunk/etc/system/default Now I must go to /splunk/etc/system/default and create a file called savedsearches.conf  allow_skew = 50% Is this value correct or what do you recommend? ... View more

I do not have control of the physical or local infrastructure, I only have access to the servers. ... View more

I have not been able to share the information since the monitor is not showing me data now 😥   "Search results might be incomplete: the search process on the peer:indexxxxx ended prematurely. Check the peer log, such as $SPLUNK_HOME/var/log/splunk/splunkd.log and as well as the search.log for the particular search."   ... View more

Done I clarify that this image is from the search head ... View more

Sorry    ... View more

Hello, thank you very much for your answer This is the information that appears, the last time that the log came from the heavy forwarder to the indexers was on September 3 According to these graphs, what could be analyzed?     ... View more

I have a heavy forwarder which receives netscaler logs through syslog using port 514 then with inputs and outputs I forward the information to the indexers. those apps are sometimes a headache about the configuration ... View more

You are absolutely right about the active use cases that do not apply to my environment, so I proceeded to deactivate all the related use cases about cloud services It is clear to me that the cause is many simultaneous searches Thank you for the information on the monitor and for being as specific as I requested, I am really very grateful for now I must deactivate other use cases and see if the hardware can be increased. I'm sorry I can't mark as a solution since I didn't start this thread ... View more

version 8.0.5 Could someone indicate what they are for or what they do and if they can be deleted or not?   ... View more

Hi, It is fine but I have seen it several times in "failed" state It's even intermittent between "Successful" and "failed" @thambisetty  what do you think is the cause? ... View more

hi @isoutamo  I will read each thread and inform you. Thank you ... View more

@trav271  What answer do I give you support? ... View more

I only share my point of view, it cannot be assumed that based on your knowledge what is obvious for you, is also obvious for all users who visit the forum. and of the few people like you who answer questions, I really want to thank. ... View more

I understand your point, and I know that it is not a definitive solution, but it is a solution in the face of the queuing was causing Splunk ES to show no information at all to at least provide a solution while reviewing in detail the issue of scheduled queries. It is clear, concise, visual and well-documented information, which is just what users in free or paid versions look for to understand the errors or alerts that the tool presents. ... View more

Did this happened regularly? Yes Which kind of environment you have? 2 Search Head 2 Indexers 2 Heavy Forwarder I have access to the monitor, but there are several menus and submenu, which option should I check exactly? Just as I investigated the problem is presented because the file called bundle is very heavy which causes the error message, my question at this time is if this bundle file can be debugged?       ... View more

Sorry for the insistence, could someone give me recommendations? 😭 ... View more