Hello Splunkers, I’ve created a search to show up all the log4j related events by looking into the strings. We are trying to dig into the events and schedule an alert. Are there any particular messages we should check in the events for log4j vulnerability? Any particular events that has high risk factor?  thanks in advance.  ... View more

Hi Splunkers. I need some ideas in showing KPI s in Splunk on Windows or Linux logs.  We have AD logs, System logs and Application logs. In Linux, We have secure logs. We are not trying to go with ITSI as of now but wanted to demo a KPI in Splunk Enterprise to other teams  to showcase the potential of Splunk. Please provide me some recommendations. Thanks in advance.   ... View more

Hi Splunkers. Could anyone give me some info on what kind of attacks I can work on based on Linux and Windows logs. I've already working on brute force attacks but my team wants me to work on other possible attacks as well. Please share some knowledge. TIA. ... View more

Hello Splunkers. I'm working on some of the usecases on ES and one of the request that I've got from my upper management is to consolidate all the usecases and their notables and send them a single email everyday. Is there any way that I can do it from the Splunk UI? Please help. Thanks. ... View more

Hi Splunkers!! I'm working with a team where they have to access to one of the saved  search results through Splunk API. The search results are more than 10k and API call returning only few results. I've checked limits.conf and it's good(limit is 50k). Any recommendations  in solving this issue. TIA. ... View more

Hi Splunkers, I'm working on Splunk and ServiceNow integration. Where ServiceNow team wants pull a report from Splunk through REST API.  Can anyone suggest me how to do it?  TIA. ... View more

Hi Splunkers, I"m working on a report where I have to write report on hosts that are not reported for a week. I used metadata to get all the hosts last reported time. Example: time                                    host 1/3/2021                          a1 1/3/2021                          b1 28/2/2021                       c1 27/2/2021                       d1 24/2/2021                       e1 22/2/2021                        f1 22/2/2021                        g1 How can I edit the field time to report  hosts on 22/2/2021 (f1 and g1) ? Your answer would be helpful Thanks in advance. ... View more

Hi Splunkers, Anyone using Tenable Scan app or add on?  I heard that monitoring can be done directly in the Tenable.  But I'm trying to leverage Splunk in my organization. Does it make any difference or bring value to monitor tenable data in Splunk? Please Shed some light into this topic. Thanks in Advance. ... View more

Hi Splunkers,   Does anyone installed Splunk for Solarwinds app? If yes, What are the advantages of getting Solarwinds data into Splunk? Also, Can I use those apps on cluster based environment? Thanks in Advance. ... View more

Hi Splunkers! This is a scenario that I came across recently, Could anyone provide me an answer. Scenario: You are upgrading Splunk Core, ES and ITSI in a hybrid environment. The on-prem portion is mostly focused towards ingestion (HFs, deployment, intermediaries) while the core Splunk application based on AWS. On-Prem and AWS use different technology stacks. 1) What is your approach to upgrading CORE, ES and ITSI with minimal interruption to customer experience? 2) What order would you upgrade Core, ES and ITSI?  Also, What order would you upgrade Splunk Components (UFs, HFs, deployment, deployers, indexers, cm, lm, mc, etc..? ... View more

Hi Splunkers! Hope you guys are doing good.  I'm working on a usecase where I have to show daily chart of overall results of search. I'm attaching a screenshot below.  I'm trying to show a daily count of the number in a line graph. For Example (see screenshot): I got 1350 dest statistics today and 1200 dest statistics yesteday. I want to show both on the line graph with dates. by doing timechart count by dest is not giving accurate results. Thanks in advance. ... View more

HI Splunkers, I'm working on a usecase where I have to report on when plain text passwords being used.  Please help me in sharing some knowledge over this usecase. Logs : Windows & Linux Regards, Revanth. ... View more

Hi Splunkers! I'm actually working on root privilege escalations with linux logs and I have limited experience with it. Can anyone please help me to give some knowledge over what Linux logs should I work on? and How I should proceed with it. Thanks in advance.   ... View more

  Hi Splunkers, With the Splunk Active Directory logs, Splunk parses the event as though there's no difference between the actor and the target of a critical event like a new account being created. How can i able to give a different name to the targeted account? Is there any way other than Regex?   Attaching a screenshot. TIA ... View more

Hello Dear Splunkers, Hope you're doing good! My organization has over 20k servers including Windows and Linux. We have so much of data coming in everyday. We are currently trying to build some usecases for the Windows AD logs. Any apps that you guys can recommend for a distributed environment which I can leverage for the AD logs?  Also, We have Splunk ES and we are trying to use it's capabilities with our overall logs. Please provide some recommendations. Thanks in Advance. ... View more