Ideally it should be managed locally in system/local - however, have you tried managing it through peer-apps? As peer-apps' Precedence will be as follow -  1. Peer-app local directories -- highest priority 2. System local directory 3. App local directories 4. Peer-app default directories 5. App default directories 6. System default directory -- lowest priority https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles#Precedence_within_global_context.2C_indexer_cluster_peers_only Please accept the solution and hit Karma, if this helps! ... View more

Hello @sushraw, Can you please try below -  | rex field=_raw "CmdSet=\[(?<CmdSet>[^\]]+)\]" The above should extract CmdSet from the events. If it looks good, you can write search time field extraction to extract the field CmdSet automatically. Please accept the solution and hit Karma, if this helps! ... View more

Hello @dood9999, Would you be able to elaborate the question in detail along with few screenshots? ... View more

Hello @Patrycja_K_ typically, server.conf and web.conf file is for below -  server.conf: This file contains configurations related to the Splunk server, such as network settings, authentication settings etc. You typically only need to manage this file on the cluster master. web.conf: This file contains configurations for the Splunk Web interface, such as UI settings, SSL settings, and HTTP server settings. Similarly, you typically manage this file on the cluster master. Can you please share if you have any specific question about server.conf and web.conf files? ... View more

Hello @sushraw, Can you please share sample events in order to create the regex? Sample event along with the field value that you want to extract. ... View more

Done, Can you please below search in Splunk and confirm if this is something you want -  | makeresults | eval data="aaa,1 ccc,3 bbb,2 ddd,4 eee,5 fff,6 ggg,1 iii,3 hhh,2 jjj,4 kkk,5 lll,6 mmm,1 ooo,3 nnn,2 ppp,4 qqq,5 rrr,6" | makemv data delim=" " | mvexpand data | rex field=data "(?<Name>\w+),(?<S_no>\d+)" | streamstats count as row_num | eval GroupNum = floor((row_num - 1) / 6) | sort GroupNum S_no | fields - _time data row_num GroupNum Output -      Please accept the solution and hit Karma, if this helps!     ... View more

Hello @ezmo1982, Yes, the exact feature was released in ES 7.2.0 - https://docs.splunk.com/Documentation/ES/7.2.0/RN/Enhancements as a part of https://ideas.splunk.com/ideas/ESSID-I-189     Please accept the solution and hit Karma, if this helps! ... View more

There's no OOTB feature, rather you can add tag/flag values in the search results itself and individual team members can just filter based on the flag. Let me know if you have any questions / thoughts? ... View more

Hello @MichalG1, ES requires 16 CPU, 32 GB Memory (https://docs.splunk.com/Documentation/ES/7.2.0/Install/DeploymentPlanning). However, if the ask is to update max_searches_per_cpu and base_max_searches on pre-prod environment (and not prod), you can go ahead and try doing that.   I would also suggest disabling the Data Model Accelerations, as well as, reviewing the correlation searches which are enabled by default - because the issue seems to be with the scheduler getting a lot of searches to execute at any given time (and not resources issue). You can also review the alert actions and corn schedules, through this search (and stagger cron schedule if needed) -  | rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",") | rename title as "Correlation Search", cron_schedule as "Cron Schedule" "dispatch.earliest_time" as "Earliest Time" dispatch.latest_time as "Latest Time" actions as "Actions" | table "Correlation Search" "Cron Schedule" "Earliest Time" "Latest Time" "Actions"   Please accept the solution and hit Karma, if this helps! ... View more

您好，请问一下问题是否已解决，或者您还有其他问题吗？ ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @mjuestel2, The annotations Dashboard would be based on the MITRE Technique value we provide in the correlation searches. Also, it's not savedsearches based on which panels work upon - it's the Risk Data Model -    Please let me know if you have any questions about the same. Also, please accept the solution and hit Karma, if this helps! ... View more

你好 @yafei, Splunk 服务器可以访问的数据没有明确的限制。 例如，如果您有分布式集群/非集群环境，则它可以访问任意数量的事件。 如果询问特定于容量规划，下面是 2 个 Splunk 文档，可以帮助您解决相同问题 - - https://docs.splunk.com/Documentation/Splunk/9.1.1/Capacity/IntroductiontocapacityplanningforSplunkEnterprise - https://docs.splunk.com/Documentation/Splunk/9.1.1/Capacity/Referencehardware 另外，这里有一个类似的问题 - https://community.splunk.com/t5/Splunk-Enterprise/Capacity-planning-best-practices-for-Splunk-Enterprise/m-p/476931   如果有帮助，请接受解决方案并点击 Karma, 或者如果您对此有任何疑问，请告诉我！ ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @Albert_Cyber, You have used the right way of Configure -> Incident Management -> Incident Review Settings -> Incident Review - Event Attributes. Just make sure you click the save button at the very bottom (I have seen a customer who had a similar issue and all it needed was to click on the "Save" button at the very end)   If the issue is still not resolved, can you please provide below information / screenshots -   - Search results showing the field is available  - Notable configuration (AR) screenshot  - Event Attributes screenshot ... View more

Hello @Rob2520, If you go to Content -> Manage Bookmarks section, there's a button for "Backup and Restore", have you tried that? Below screenshot for reference -  Please accept the solution and hit Karma, if this helps! ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @jmmontejo, I am unable to run the Dashboard in Splunk. Can you please paste the full XML? ... View more

Hello @10061987, You can use fields from the first line of the results in the alert, e.g. $result.email$ assuming your search includes the email field. Then if you trigger the alert for each result (rather than just once), each result will execute the action with its corresponding row from the events. Reference - https://community.splunk.com/t5/Alerting/Splunk-Alerts-How-to-use-email-address-from-variable/m-p/633020#:~:text=You%20can%20use%20fields%20from,corresponding%20row%20from%20the%20events.   Please accept the solution and hit Karma, if this helps! ... View more