Hello @sidtalup27, I don't think there is any licensing mechanism for ES. It's just you need to purchase ES app at an upfront cost and the existing Splunk license will be used. Ref Doc - https://docs.splunk.com/Documentation/ES/7.1.1/User/Licenses You can have a check with Splunk Sales though.   Please accept the solution and hit Karma, if this helps! ... View more

Hello, Just checking through if the issue was resolved or if you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello, Just checking through if the issue was resolved or you have any further questions? ... View more

Hello @DanAlexander, In a Splunk environment, logs from Active Directory (AD) can be collected using various methods, including both agent-based and agentless approaches. Let's explore both options: 1. Agent-Based Approach: With the agent-based approach, you would install a Splunk Universal Forwarder (a lightweight data collection agent) on the AD domain controller machine(s). The Universal Forwarder is responsible for gathering logs from the specified sources on the machine and forwarding them to the Splunk indexer for indexing and storage. The advantage of using the Universal Forwarder is that it allows you to filter and select the specific logs you want to collect from the AD DC machine(s), reducing unnecessary data transfer and storage. 2. Agentless Approach: In some cases, you can collect AD logs without directly installing an agent on the domain controller. This is achieved by using protocols such as syslog or Windows Event Forwarding (WEF). Here's how it works: - Syslog: If your AD DC machine supports sending logs to a syslog server (e.g., using the syslog protocol), you can configure it to send relevant log data to a Splunk syslog server. The Splunk syslog server can then index and store these logs for analysis. - Windows Event Forwarding (WEF): This is a built-in Windows feature that allows you to forward specific Windows event logs (e.g., security logs) from the AD DC to a central event collector. Splunk can act as the event collector, and you can configure the AD DC to forward the desired logs to your Splunk instance. Both approaches are valid, and the choice between them depends on your organization's requirements, security policies, and technical constraints. If you are using a Splunk infrastructure, it is common to utilize the Universal Forwarder as it provides more control over log collection and allows filtering on the source machine before forwarding the data to Splunk. Remember that whatever method you use, it is essential to ensure proper permissions and security considerations when collecting logs from sensitive systems like domain controllers.   Usually, the agent approach is preferable - where you can have an AD tree and install UF on the top to ingest the events. Also, you can provide specific DN/DC etc in the input configurations to better filter events.   Please hit Karma, if this helps! ... View more

It actually supports! From Summary section of the app -  Supported Cisco Devices: * Cisco Catalyst series switches (2960, 3650, 3750, 4500, 6500, 6800, 7600 etc.) * Cisco ASR - Aggregation Services Routers (900, 1000, 5000, 9000 etc.) * Cisco ISR - Integrated Services Routers (800, 1900, 2900, 3900, 4451 etc.) * Cisco Nexus Data Center switches (1000V, 2000, 3000, 4000, 5000, 6000, 7000, 9000 etc.) * Cisco Carrier Routing System * Other Cisco IOS based devices (Metro Ethernet, Industrial Ethernet, Blade Switches, Connected Grid etc.) * Cisco Access Points * Cisco WLC - WLAN Controller ... View more

Not sure based on dropdown menu, however, I found one of the Dashboards from "Splunk Dashboard Examples" named "Custom Token Links", with below source code. It shows/hides Chart and Table -    custom_token_links.xml <dashboard version="1.1" script="tokenlinks.js"> <label>Custom Token Links</label> <description>Set tokens from links or buttons in HTML panels.</description> <search id="base1"> <query>index=_internal | timechart count by sourcetype</query> <earliest>-24h</earliest> <latest>now</latest> </search> <search id="base2"> <query>index=_internal | timechart count by sourcetype</query> <earliest>-24h</earliest> <latest>now</latest> </search> <row> <panel> <title>Link Switcher Example</title> <html> <!-- Set the $show_chart$ token when the link is clicked, also unset the $show_table$ token --> <a href="#" class="btn-pill" data-set-token="show_chart" data-value="show" data-unset-token="show_table"> Show Chart </a> <!-- Set the $show_table$ token when the link is clicked, also unset the $show_chart$ token --> <a href="#" class="btn-pill" data-set-token="show_table" data-value="show" data-unset-token="show_chart"> Show Table </a> <!-- Unset both the $show_chart$ and $show_table$ token when the link is clicked --> <a href="#" class="btn-pill" data-token-json='{"show_table": null, "show_chart": null}'>Hide All</a> </html> <chart depends="$show_chart$"> <search base="base1"/> </chart> <table depends="$show_table$"> <search base="base1"/> </table> <html rejects="$show_chart$, $show_table$"> <p>Click on one of the links above to select which visualization to show.</p> </html> </panel> </row> <row> <panel> <title>Button Switcher Example</title> <chart> <search base="base2"/> </chart> <html> <button class="btn" data-set-token="show_details" data-value="show">Show Details</button> </html> </panel> <!-- The panel is only shown once the user clicks on the button and the $show_details$ token is set --> <panel depends="$show_details$"> <table> <title>Details</title> <search base="base2"/> </table> <html> <h2>Sample Description</h2> <p>This is some sample description that only shows up if you click on the "Show Details" button.</p> <button class="btn" data-unset-token="show_details">Hide Details</button> </html> </panel> </row> </dashboard>   tokenlinks.js -  requirejs([ '../app/simple_xml_examples/libs/jquery-3.6.0-umd-min', '../app/simple_xml_examples/libs/underscore-1.6.0-umd-min', 'util/console', 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function($, _, console, mvc) { function setToken(name, value) { console.log('Setting Token %o=%o', name, value); var defaultTokenModel = mvc.Components.get('default'); if (defaultTokenModel) { defaultTokenModel.set(name, value); } var submittedTokenModel = mvc.Components.get('submitted'); if (submittedTokenModel) { submittedTokenModel.set(name, value); } } $('.dashboard-body').on('click', '[data-set-token],[data-unset-token],[data-token-json]', function(e) { e.preventDefault(); var target = $(e.currentTarget); var setTokenName = target.data('set-token'); if (setTokenName) { setToken(setTokenName, target.data('value')); } var unsetTokenName = target.data('unset-token'); if (unsetTokenName) { setToken(unsetTokenName, undefined); } var tokenJson = target.data('token-json'); if (tokenJson) { try { if (_.isObject(tokenJson)) { _(tokenJson).each(function(value, key) { if (value === null) { // Unset the token setToken(key, undefined); } else { setToken(key, value); } }); } } catch (e) { console.warn('Cannot parse token JSON: ', e); } } }); }); ... View more

AFAIK, The notable time is the time when the event gets triggered and indexed (and not _time from the events). However, I have heard that there is a feature in the upcoming version of ES where we can select notable time. ... View more

Were you able to resolve this @hoangpt? ... View more

Were you able to resolve this @code_assassin?   Please accept the solution if this helps! ... View more

Hello @VK18, There is no native way of "suppressing" Risk events like notable (as mentioned here - https://docs.splunk.com/Documentation/ES/7.1.1/User/RiskScoring#:~:text=It%20is%20also%20worth%20noting%20that%20risk%20modifiers%20cannot%20be%20suppressed%20in%20the%20same%20manner%20as%20notable%20events.%20Instead%2C%20the%20following%20options%20are%20available%3A)   We can use alert throttling OR add ad-hoc Risk entry from Risk Analysis Dashboard. Below are the reference Docs -  Create an ad hoc risk entry in Splunk Enterprise Security - https://docs.splunk.com/Documentation/ES/7.1.1/User/Createadhocriskentry Suppressing false positives using alert throttling - https://docs.splunk.com/Documentation/ES/7.1.1/RBA/UseDynamicThrottling   Also, if you are using Risk Notable (Notable that gets triggered when a certain threshold is reached), you can also filter / blacklist Risk Object through lookup.   Please accept the solution if this helps! ... View more

Glad it is resolved now!   Feel free to accept answer if the troubleshooting steps helped : ) ... View more

Hello @Naa_Win, AFAIK you will not be directly able to use the country/region name in the map. Rather you will need to create latitude longitude table (or perhaps one would be easily available over the internet) and populate the lat-long results in the search. Post which you will be able to map the region in the Dashboard.   Below links would be helpful to you -  https://www.youtube.com/watch?v=_XosRgjd-KI https://www.youtube.com/watch?v=3-d59yOvGns https://www.splunk.com/en_us/blog/platform/dashboard-studio-more-maps-more-interactivity.html?locale=en_us Pre-defined "example-hub-world-map-visualization"  Dashboard from splunk-dashboard-studio app   Please accept the solution if this helps! ... View more

Hello @VK18, Please install the app on a single Heavy Forwarder if you have one. If not, you can install the app on any one indexer per the doc - https://duo.com/docs/splunkapp#distributed-search. Although, installing the app on a single indexer is not suggested as it can be a single source of failure (meaning if the indexer goes down, you will stop receiving events.   I would suggest option is following order -  1 - Heavy Forwarder 2 - Search Head 3 - Any one Indexer   Please accept the answer if that helps! ... View more

Hello @Kazu_, (instead of uploading the app) Have you tried extracting the app directly in etc/apps and restarting Splunk?  Please accept that answer if that works! ... View more

Hello @xiantros, Can you please try explicitly using strftime function and verify if it helps? Example below -  eval Time=strftime(_time,"%m/%d/%y %H:%M:%S")   Please accept the answer if that helps! ... View more

Hello @ssuluguri, Can you please confirm below -  How the _time is being extracted? If it's based on events - can you validate if the timestamp extraction is performed correctly? Can you check queues on the indexers? Can you run the search on real-time in Splunk along with running tcpdump on the host and validate if both are matching? ... View more