I'm trying to read a json file generated by a ps1 script on Windows, but the UF keep truncating the json as soon it finds a valid timestamp. Removing the timestamp 'fixes' the problem, but I need the timestamps. I've a similar script running on unix machine and the issues is not appearing there. My props is the following: [sourcetype_name] TRUNCATE = 0 BREAK_ONLY_BEFORE_DATE = false DATETIME_CONFIG = NONE MAX_TIMESTAMP_LOOKAHEAD = 0 INDEXED_EXTRACTIONS = JSON I'm starting to think that it's a bug on Windows UFs. ... View more

Hello, I'm unable to get field validation in a Custom Adaptive Response Action in Splunk Enterprise Security. What I would like to achieve is a field validation that obliges the user to fill the field (required field) but I can't get even the simplest validation working. When I click on the run button in the adaptive actions modal view on the incident, I get no validation but a message saying "action has been dispatched". Furthermore which field should I put in alert_actions.conf.spec and savedsearched.conf.spec? The documentation I have read is quite vague. Thanks! ... View more