AFAIK, The notable time is the time when the event gets triggered and indexed (and not _time from the events). However, I have heard that there is a feature in the upcoming version of ES where we can select notable time. ... View more

Were you able to resolve this @hoangpt? ... View more

Were you able to resolve this @code_assassin?   Please accept the solution if this helps! ... View more

Hello @VK18, There is no native way of "suppressing" Risk events like notable (as mentioned here - https://docs.splunk.com/Documentation/ES/7.1.1/User/RiskScoring#:~:text=It%20is%20also%20worth%20noting%20that%20risk%20modifiers%20cannot%20be%20suppressed%20in%20the%20same%20manner%20as%20notable%20events.%20Instead%2C%20the%20following%20options%20are%20available%3A)   We can use alert throttling OR add ad-hoc Risk entry from Risk Analysis Dashboard. Below are the reference Docs -  Create an ad hoc risk entry in Splunk Enterprise Security - https://docs.splunk.com/Documentation/ES/7.1.1/User/Createadhocriskentry Suppressing false positives using alert throttling - https://docs.splunk.com/Documentation/ES/7.1.1/RBA/UseDynamicThrottling   Also, if you are using Risk Notable (Notable that gets triggered when a certain threshold is reached), you can also filter / blacklist Risk Object through lookup.   Please accept the solution if this helps! ... View more

Glad it is resolved now!   Feel free to accept answer if the troubleshooting steps helped : ) ... View more

Hello @Naa_Win, AFAIK you will not be directly able to use the country/region name in the map. Rather you will need to create latitude longitude table (or perhaps one would be easily available over the internet) and populate the lat-long results in the search. Post which you will be able to map the region in the Dashboard.   Below links would be helpful to you -  https://www.youtube.com/watch?v=_XosRgjd-KI https://www.youtube.com/watch?v=3-d59yOvGns https://www.splunk.com/en_us/blog/platform/dashboard-studio-more-maps-more-interactivity.html?locale=en_us Pre-defined "example-hub-world-map-visualization"  Dashboard from splunk-dashboard-studio app   Please accept the solution if this helps! ... View more

Hello @VK18, Please install the app on a single Heavy Forwarder if you have one. If not, you can install the app on any one indexer per the doc - https://duo.com/docs/splunkapp#distributed-search. Although, installing the app on a single indexer is not suggested as it can be a single source of failure (meaning if the indexer goes down, you will stop receiving events.   I would suggest option is following order -  1 - Heavy Forwarder 2 - Search Head 3 - Any one Indexer   Please accept the answer if that helps! ... View more

Hello @Kazu_, (instead of uploading the app) Have you tried extracting the app directly in etc/apps and restarting Splunk?  Please accept that answer if that works! ... View more

Hello @xiantros, Can you please try explicitly using strftime function and verify if it helps? Example below -  eval Time=strftime(_time,"%m/%d/%y %H:%M:%S")   Please accept the answer if that helps! ... View more

Hello @ssuluguri, Can you please confirm below -  How the _time is being extracted? If it's based on events - can you validate if the timestamp extraction is performed correctly? Can you check queues on the indexers? Can you run the search on real-time in Splunk along with running tcpdump on the host and validate if both are matching? ... View more

Hello @halime Can you please verify the share level of the macro? - if it's private, app-level or Global? Because at times, you may have read permission but the search query needs to be run from a specific app (if it's app level permission), and not from any other app.   Also, AFAIK "drop_dm_object_name" is the default macro from "Splunk_SA_CIM", so you may want to install the app (https://splunkbase.splunk.com/app/1621) instead of creating a macro on your own.     Please accept the answer if it helps! ... View more

I suspect "dedup" is the culprit, can you please remove the same and fit "stats dc()" or "stats count" or so and validate the results? ... View more

Hello @ornaldo, Can you please confirm -  Are you directly monitoring the port on which syslog-ng is sending data? If so, have you validated through tcpdump that events are actually being ingested on host? If you are performing file monitoring, have you checked if the necessary files are being generated on the host? If not, can you please check syslog-ng configuration? If the ingestion is through file monitoring, can you please check if the files / folders are matching the inputs.conf configuration. For example inputs.conf may monitor abc.* but file name is abd.txt Check the file permission and confirm Splunk has read access to those files Double-check if all the logs are missing from that host? If so, can you verify the connectivity, certificate configurations, queues etc. ... View more

Hello @Deprasad, In this case if B is dependent on A and C is dependent on B - so C is indirectly dependent on A.   Which means you can just mention A in the search of C's drill-down which will automatically re-populate the results or show "Search produced no results."   Example below -    <form version="1.1"> <label>Test</label> <fieldset submitButton="false"> <input type="dropdown" token="field1"> <label>field1</label> <fieldForLabel>index</fieldForLabel> <fieldForValue>index</fieldForValue> <search> <query>| tstats count where index=* by index | fields - count</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="field2"> <label>field2</label> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>| tstats count where index=$field1$ by source | fields - count</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="field3"> <label>field3</label> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <search> <query>| tstats count where index=$field1$ source=$field2$ by sourcetype | fields - count</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input> </fieldset> </form>     Please accept the answer if it helps! 🙂 ... View more

Hello @hoangpt you can use deployer_push_mode from app.conf (https://docs.splunk.com/Documentation/Splunk/9.0.5/Admin/Appconf) if you temporary wants to use it for a specific app.   It will ensure that not all changes are following deployer_push_mode except a particular app   Please let me know if you have any questions or feel free to accept the answer if that helps ... View more

Hello @splunkbunk, You can update the urgency under incident_review_lookup once you run the saved search that notifies users. ... View more

Hello @AL3Z, The best way would be using isnull as documented here - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/InformationalFunctions#isnull.28.26lt.3Bvalue.26gt.3B.29   Feel free to accept answer if this helps! ... View more

Hello @gauravu_14 Can you please share earlier and upgraded version of ES? Also, would you be able to share screenshot of the issue to better understand? ... View more