Not sure if this is what you mean by tuning, but here it goes. Access - Geographically Improbable Access Detected - Rule uses the index=gia_summary, which is populated by the Access - Geographically Improbable Access - Summary Gen. You can add a |search to the end of the original search, and add your exclusions there.  Such as | search src!=8.8.8.8  Depends on how wide of an exclusion you need, you may be better off using a lookup table to add exclusions. Hope this helps. ... View more

Way late to the game, but for anyone that is looking for something like this, you may try insert this in your search. It will make the host field multivalue based on the comma. | inputlookup | makemv delim="," host ... View more

I wish I could upvote more than once. Worked great. I feel like this should be better monitored by Splunk and alerted upon when nearing expiration. Going to create our own alerting for these. Does the server.pem need to be renewed on universal forwarders also? ... View more

Try this index=(my index) sourcetype="my_source" |search [|inputlookup threatip.csv | fields ip |rename ip as srcip] ... View more

On 7.1 or newer, you'll need to use the user.seed.conf. Hurricane Labs has a good rundown on how to do it. https://www.hurricanelabs.com/splunk-tutorials/splunk-7-1-performing-a-splunk-password-reset ... View more

Same issue on UF 7.2.0 Indexer 7.3.1 ... View more

Not sure if your data is coming in JSON or not, but I've seen the same issue with KV extractions with JSON. I had to add a local props.conf with the below stanza to the SH to resolve. This disabled the KV_MODE config on the SH. [source::foo] KV_MODE = NONE You can disable the KV_MODE on either the SH or the forwarder. Disabling on the forwarder will use search-time extractions, disabling on SH will use index-time extractions. Again, not sure if your data is JSON or not, but hope this helps. ... View more

"I want to fire an event when the token is set, and update the value of the multiselect, but there doesn't seem to be any way to do that that I can figure out..." You can pass a token to a search string in your multiselect. It won't set the default, but it will update the available values for the multiselect. </input> <input type="multiselect" token="attack_type"> <label>Attack Type</label> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>attack_type</fieldForLabel> <fieldForValue>attack_type</fieldForValue> <search> <query>index=attack sourcetype=attack:syslog eventtype=attack $policy_name$ | stats count by attack_type $time.earliest$ $time.latest$ attack_type=" " OR ... View more

Add the |sort - count after the |addcoltotals. It will sort your count by greatest to least. {your search} | addcoltotals | sort - count ... View more

@dfoster_splunk this worked great! Thank you! I had tried everything else I could think of to escape so users could input searches into a dashboard input that outputs to a lookuptable. This fixed it. I wonder if the issue norskedm was having was if you try to add it to the search, but not through the XML, it didn't seem to work. ... View more

$env:user$ only works some times. Sometimes it will pass the user ID of another logged on user. ... View more

I believe the windows_apps.csv changes would be overwritten when you update the Splunk_TA_Windows. ... View more

Very late to the party for this one, but from the Home page in the Enterprise Security App, select App configuration. This will take you to the ES Configuration. Under General, select Navigation. This will let you edit/add views to the menu. Regards, jbillings ... View more

The solution was I changed the docsCheckerBaseURL URL to https://quickdraw.splunk.com/help and I'm able to reach the documentation now. Thank you for your help working on this. ... View more

Thank you for working on this Chris. What is your Web.conf CheckerBaseURL set to? ... View more

I have other extensions, but none are blocking. I get "help?location=manager.apps.local:142 GET http://docs.splunk.com/Documentation/pro/7.1.2/manager.apps.local/prod/default?locale=en-US&product=enterprise net::ERR_ABORTED 404 (Not Found)" ... View more

I receive "Unable to access online documentation. Please ensure docsCheckerBaseURL in web.conf is correct." with pop-up blocker turned off, no blocking. Do you know what the configuration for docsCheckerBaseURL in web.conf should look like? https://localhost:8000/en-US/help?location=learnmore.datamodel.about ... View more