More often than not it would be because of the default macro not being updated - which has information about "in which index the data resides". As @Bhumi suggested, can you share the name of the TA to assist you more? ... View more

Hello @zksvc Was the notable created after you updated the next actions - or was it already generated and later you updated the Correlation Search? ... View more

Hello @grep, Can you please try removing whitelisting from the "CIM Setup" page and only have condition available from Macro page? Let me know if it doesn't work and I can troubleshoot. ... View more

You can use addtotals as below -  | addtotals col=t row=f labelfield=index label="Overall Total"   Please accept the solution and hit Karma, if this helps! ... View more

This one have always help with all Azure onboarding questions, want to give it a try? - https://jasonconger.com/splunk-azure-gdi/ Reference -  https://www.splunk.com/en_us/blog/tips-and-tricks/getting-microsoft-azure-data-into-splunk.html?locale=en_us     ... View more

Not sure if https://splunkbase.splunk.com/app/1761 helps? ... View more

Hello @yuvaraj_m91  Can you please elaborate the question a bit? ... View more

Hello @heskez Yes it's possible. You can have a custom lookup popped-up and integrate the same local intel - https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Addlocalthreatintel   Please hit Karma, if this helps! ... View more

Hello @splunky_diamond, As stated by 2 folks, resource consumption depends on multiple factors. If you are planning to enable ~15 use cases in ES for learning purpose with all-in-one test environment, 32 GB RAM, 32 vCPU, and 200 GB hard disk should be enough. Base configuration for ES is as below -  https://docs.splunk.com/Documentation/ES/7.3.1/Install/DeploymentPlanning ... View more

Better to raise Splunk Support case for better troubleshooting 🙂 ... View more

Hello @dc18, have you checked https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatch and searched for EC2 on the page? ... View more

+1 with @TheLawsOfChaos, It's a common practise to create a Role with "Read Only" permission. You have any further questions / issues with respect to this @treven? ... View more

Hello @493600, There is no OOTB of achieving this. Usually, we have to download the events in _raw format, upload it on a test environment which has latest version of TA along with CIM Validator installed - and validate the field extraction. Commands like fieldsummary can help in comparing the field name and values - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldsummary   Please accept the solution and hit Karma, if this helps! ... View more

Hello @matoulas Can you please elaborate the question? One liner isn't seems to define the actual problem 🙂 ... View more

Let me agree with your disagreement 🙂 Do you agree with the answer though is the question - The 4 points mentioned initially to centrally get the events on a single server and monitor the same? ... View more

Hello @PickleRick the other 4 points you mentioned was of no use, which is why it's not included in the answer. Couple of points -  1. The question author have mentioned - " I'm fairly new to Splunk and I'm still learning how to set things up so as many details as possible would be helpful." - Which is why the answer mentions about having everything at one place and monitor it later - which is usual practice. 2. Community answer initiate a "thread" where further discussion can be in place about what and how to achieve the solution 3. The question also mentions "I believe the process is to have the printers redirect their logs to the print server to a specific folder, then add that folder to the list of logs being reported in the Splunk forwarder. Does that sound correct?" - which is the one of the best way to monitor the logs from one place. 4. It's not copy-pasting answer, it's about taking a reference -> looking over authenticity -> Updating it as required and sharing with community. One could literary ask each and every Splunk Community question over GPT and paste the answers - but that's not being happened. We as a community wants to use new tools along with making sure whatever we are posting is authentic and actually helps the ones who posts here 🙂 ... View more

Hello, Just checking through if the issue was resolved or you have any further questions?  ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @splunkreal, Just checking through if the issue was resolved or you have any further questions? If not, can you please accept the answer, so anyone in the future having the same question can get the solution quickly? ... View more

Hello @maverick27 sort should work in that case right? ie. -  | sort GroupNum S_no ... View more

Hello @SplunkDash, Can you please check below -  | makeresults | eval _raw="accid,nameA,addressA,cellA 002,test1,tadd1,1234 003,test2,tadd2,1256 003,test2,tadd2,5674 004,test3,tadd3,2345 005,test4,tadd4,4567 006,test5,tadd5,7800 006,test5,tadd5,9900" | multikv forceheader=1 | eval sourcetype="sourcetypeA" | append [| makeresults | eval _raw="accid,nameB,addressB,cellB 002,test1,tadd1,1234 003,test2,tadd2,5674 004,test3,tadd3,2345 005,test4,tadd3,4567 006,test5,tadd5,9900" | multikv forceheader=1 | eval sourcetype="sourcetypeB" ] | kv | stats values(*) as * by accid | where mvcount(nameA) != mvcount(nameB) OR mvcount(addressA) != mvcount(addressB) OR mvcount(cellA) != mvcount(cellB)   Please let me know if you have any questions for the above. Please accept the solution and hit Karma, if this helps! ... View more

Hello @VashisthaPandya, Do you really want to have a "real-real" traffic or dummy would work? Because you can generate dummy Windows EventCode traffic through EventGen (https://splunkbase.splunk.com/app/1924) and deploy it and focus on writing effective search query. ... View more

Hello @ezmo1982 , Just checking through if the issue was resolved or you have any further questions? ... View more