Hi Splunkers, in ES Content Update there's detection rule that requires a prebuild MLTK model that is formed by a search "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK". And the search uses macro ec2_excessive_terminateinstances_mltk_input_filter , that can not be found neither in ESCU nor other apps. Is it more a Support case or someone may help with this macro?   ... View more

Hi Splunkers, we need to monitor who, when, where and what was changed in macros, searches and so on. Internal index can answer to "who, when, where" (audit POST requests).  Which is the right and preferred way to answer to "what" exactly was added or removed to/from the knowledge object during the change operation. P.S. We have to have this information in Splunk and correlate with _internal audit ... View more

Hi Splunkers, We have an indicator of a phishing source from email headers - a PC name. We need to add it to a Threat Intel collection for ES. I did not find an appropriate one to use. Should we create a custom list or would any of the pre-existing ollections work with it? ... View more

Hi Splunkers , any advice how to avoid mixng values in assets by entitymerge command? I have 5 fileds marked as Multivalue (category, ip, mac) and sometimes it cause trouble like multiple assets mapped to all existing categories or multiple IP addresses, and thus incorrect notable events. Do I understand correctly that I should mark fields as Multivalue if there might be several valuse (like 2 mac addresses for computer or several categories (router|network) ? SE V7.3.3, Enterprise Security Version 6.0.1 Build 2 ... View more

Hi Splunkers, we have centralized syslog collector. Also many hosts deliver logs via UFs directly. The same index may contain data delivered from UFs and from syslog inputs. Also we have DB connectors and APIs. Is it possible to divide data by type of input? Does Splunk have this kind of inspection? ... View more

Hi Team , in Splunk Add-on for McAfee you have query option in inputs (template\example) configuration : [EPOEvents].[ThreatActionTaken] as [vendor_action] . Then we have 2 neighbours in props.conf: FIELDALIAS-vendor_action_for_mcafee_epo=action AS vendor_action LOOKUP-action_for_mcafee_epo=epo_action_lookup vendor_action OUTPUT action According to sequence of operations, value of vendor_action obtains the value of action , which is obviously NULL . As a result both action and vendor_action returns NULL . Could you, please correct this or correct me, if I'm wrong 🙂 ... View more

Hi Splunkers, we had copied many searches to the search head node from indexer and now we have many errors like this: DispatchManager - Search not executed: reason="The maximum disk usage quota for this user has been reached.", usage=12513MB, quota=10000MB, user=splunk-system-user . In Savedsearch menu all these failed searches are owned by nobody . In Jobs menu there are many searches with status Done and size around 128 Mb, but the size of the dispatch folder does not correspond to the size of searches in Jobs menu (is it normal?). We've increased quota up to 30 Gb, and this didn't help. How can we resolve it or where to look at? Will reassignment to other user help? ... View more