Hi All, I have gone though all the answers and done all required changes in config but nothing will happend. Finally, I use below steps to reslove this issue. Backup your files, if exist, ex: db_input.conf and drivers Stop splunk. Remove db_connect app from app folder. Restart Splunk. Upgrade your splunk with just new version. install > db connect app check your db it will be okay now. Happy Splunking !.. ... View more

In your drill down search you can use the source event values by referencing the field name wrapped in $ - for example, if you want to search by the src field value from the notable event your drill down search criteria would include src=$src$ . I believe the values that you want to reference have to be defined in the Enterprise Security Configuration: "Incident Review Settings" -> "Incident Review - Event Attributes" table, and remember if you're using a datamodel in your correlation search that you have to remove the datamodel object name from the field names in that correlation search, for example: | rename IDS_Attacks.* as * .. or the built in macro drop_dm_object_name: | `drop_dm_object_name("IDS_Attacks")` ... View more

It works! Thanks. ... View more