Check your email settings, try to send emails manually from cmd if that is working then check in your app setting where you've defined mail settings. On the server side, mail setting should be in only one place, may be you've defined it some where else as well. Thanks, Rajan Shrivastav ... View more

I'm using this with super-admin role also, I've essadmin & admin privileges but none of them working. Also I upgraded enterprise security app to 4.7.6 but this didn't help. Thanks, ... View more

I'm using Splunk 6.5.3 & Splunk App for Enterprise Security app version 4.5.0. There is no error showing in the browser. Only thing, I'm not seeing any option to edit under the incident review page. Earlier it was showing and edit notable events section in incident review page is not visible and we couldn't change the status of each of the notable alerts and provide comments. Please let me know if you need any more info. Thanks, ... View more

Blockquote 1536009195.1426 Blockquote ... View more

" 1536009195.1426 " ... View more

After running above command, it is showing following result- 1536009195.1426 ... View more

Hi, you can install splunk app for aws and in the configure section add your aws account by access key & secret key. for billing section, the query will be like - aws-billing-cloudwatch((aws_account_id=""), "") | stats max(Sum) as sum by metric_dimensions LinkedAccountId | rex field=metric_dimensions ".Currency=[(?.?)]" | stats sum(sum) as sum by Currency | sort -sum | head 1 | nadefault sum by default this splunk app for aws will automatically fetch billing data from your aws account , for this you need an IAM credentials(access key & secret key) which has read access to all resources. Thanks, Rajan Shrivastav ... View more

Hi, you can install splunk app for aws and in the configure section add your aws account by access key & secret key. for billing section, the query will be like - aws-billing-cloudwatch((aws_account_id="*"), "*") | stats max(Sum) as sum by metric_dimensions LinkedAccountId | rex field=metric_dimensions ".Currency=[(? . ?)]" | stats sum(sum) as sum by Currency | sort -sum | head 1 | nadefault sum by default this splunk app for aws will automatically fetch billing data from your aws account , for this you need an IAM credentials(access key & secret key) which has read access to all resources. Thanks, Rajan Shrivastav ... View more

No, I didn't renamed the App. ... View more

Yes, inside the lookup editor app. ... View more

[root@splunk-prod2 metadata]# vim local.meta [app/install/install_source_checksum] version = 6.4.2 modtime = 1470899674.831067000 [] access = read : [ * ], write : [ * ] export = system version = 6.5.3 modtime = 1518605602.193440000 [nav/default] access = read : [ * ], write : [ admin, soc_edit_lookups ] export = system owner = nobody version = 6.5.3 modtime = 1520116817.352097000 [views/lookup_edit] access = read : [ * ], write : [ admin, soc_admin_role, soc_edit_lookups ] export = system owner = nobody version = 6.5.3 modtime = 1520116785.563633000 [views/lookup_list] access = read : [ * ], write : [ admin ] export = system owner = nobody version = 6.5.3 modtime = 1520116794.498257000 [views/lookup_new] access = read : [ * ], write : [ admin ] export = system owner = nobody version = 6.5.3 modtime = 1520116803.294667000 [app/ui] version = 6.5.3 modtime = 1519038393.200598000 and permission of local.meta is 777 for now. Still getting the same issue Error -- The lookup could not be loaded from the server Right-click the table for editing options ... View more

@valiquet, can you please explain a little more, how you fixed this issue. Thanks, ... View more

I've set permission to 755 in /$SPLUNK_HOME/etc/app/ ... View more