Hi, how can i correlate events from different indexes when both( field names and  values) are different ? For example: I have a some app logs  in an index=id1 . There is field called user in this index   which has values like: SmithJ JohnK  Now i want to find out what is the IP address of these users from our firewall index.  But  In the Firewall index,  the user names are in following format: Field Name:  PanOSSourceUserName Value:  <Domain>\SmithJ Field Name:  PanOSSourceUserName Value:  <Domain>\JohnK As you can see, the firewall index has names appended by our <domain name>\ while the app index doesn't have domain name in the user field.    There are other fields called src_ip and Country in firewall events. How can i craft  a search that takes the user field from app index and compares/ correlates that with the PanOSSourceUserName field from Firewall index and accordingly displays the src_ip of the user .  Hope i am clear. End result:  Table or Stats whatever works with following columns  _time user PanOSSourceUserName src_ip Country               Thanks in advance    ... View more

Gentlemen, We are on Splunk Cloud. In my raw events coming from AWS , splunk by default shows a field called "category" under "Interesting fields" . However, it's value ( as in it's extraction)  isn't what we are expecting it to be. It only manages to extract a part of the complete string.   For example:   The raw events have category as follows (In JSON format)  "Policy:IAMUser/RootCredentialUsage"   (without quotes) But Splunk is instead showing the value of category as:  Policy   .Now,  whats happening is if i use the IFX or rex command to create a field extraction  keeping the same name for my field i.e.  category and value: Policy:IAMUser/RootCredentialUsage   ,  my newly extracted field keeps getting overwritten with the default old values again . I am assuming this is because  the names of the fields are same  ( category) , so splunk takes its own precedence.  IS this the case of Index time vs Search Time field extraction conflict ? How to make Splunk use whatever value my field extraction ( as in rex or IFX) is extracting for category and at the same time also retain its name as is ?   Dont want the category field to display its old indexed value. ... View more

Hi All,   Does Splunk Security Essentials app also map our custom (user defined) correlation searches to different MITRE tactics ?  I know it does so for the pre defined ones but what about for user defined searches? Thanks ... View more