Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About aakwah
aakwah
Builder
Member since:
07-22-2013
03-16-2023
Community Statistics
| Posts | 158 |
| Solutions | 18 |
| Karma Given | 46 |
| Karma Received | 31 |
| Member Since | 07-22-2013 |
Activity Feed
- Got Karma for Re: How to change the event time of ES Incident Review. 03-14-2023 02:28 PM
- Got Karma for Re: Where can I view created notable alert suppression entries in ES?. 01-06-2023 09:44 AM
- Posted Re: Workflow Action - Mailto on Knowledge Management. 12-30-2022 01:24 AM
- Karma Re: Workflow Action - Mailto for haraksin. 12-30-2022 01:22 AM
- Posted Re: Where can I view created notable alert suppression entries in ES? on Splunk Enterprise Security. 12-20-2022 02:20 AM
- Karma Re: Data export from Splunk via rest API for aasabatini. 12-19-2022 01:59 AM
- Posted Re: Enterprise Security Incident Review Auto Refresh on All Apps and Add-ons. 09-30-2022 06:12 AM
- Posted Re: Enterprise Security Suite Incident Review - How Do You Edit the Owners List? on Splunk Enterprise Security. 09-30-2022 05:31 AM
- Got Karma for Re: Incident Review Auto-Refresh. 09-30-2022 04:56 AM
- Posted Re: Incident Review Auto-Refresh on Splunk Enterprise Security. 09-30-2022 04:31 AM
- Posted Re: Time format for column Receipt Time in Incident Review window on Splunk Enterprise Security. 09-26-2022 02:44 AM
- Tagged Re: How to change the event time of ES Incident Review on Splunk Enterprise Security. 09-16-2022 06:24 AM
- Posted Re: How to change the event time of ES Incident Review on Splunk Enterprise Security. 09-16-2022 06:23 AM
- Posted Re: Splunk Enterprise Security: How can I edit a notable table in the Incident Review dashboard to alternate row colors? on Splunk Enterprise Security. 09-13-2022 12:30 PM
- Posted How to change notable event row color or the color of any field in incident review dashboard? on Splunk Enterprise Security. 09-13-2022 05:42 AM
- Tagged How to change notable event row color or the color of any field in incident review dashboard? on Splunk Enterprise Security. 09-13-2022 05:42 AM
- Karma Re: Splunk ES Notable events not getting triggered for diwakar. 07-07-2022 01:50 AM
- Got Karma for Re: How can I get a complete list of processes used by Splunk for Linux?. 06-09-2021 08:45 AM
- Karma Re: Merging TWO Timecharts overlay-One on Top of One Another for koshyk. 02-10-2021 02:50 AM
- Got Karma for Re: Strange search behavior with "transaction". 01-01-2021 02:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-30-2022
01:24 AM
I believe this should be the answer of the question as non of the other solutions worked for Splunk ES version 7. sendemail - Splunk Documentation
... View more
12-20-2022
02:20 AM
1 Karma
You can delete Suppressions from "Event types" page.
... View more
09-30-2022
06:12 AM
Hi, I found a workaround to auto-refresh Incident Review dashboard by adding these 3 lines below to this html file as it is already included in Incident Review dashboard xml file. /opt/splunk/etc/apps/SA-ThreatIntelligence/appserver/templates/generic.html <head> <meta http-equiv="refresh" content="300"> </head> This will refresh the page after 300 seconds (5 mins). <%inherit file="base.html"/>
<head>
<meta http-equiv="refresh" content="300">
</head>
<div class="preload">
<div id="placeholder-splunk-bar">
<a href="${make_url([])}" class="brand" title="splunk > listen to your data">splunk<strong>></strong></a>
</div>
<div id="placeholder-app-bar"></div>
<div id="placeholder-main-section-body">
${_('Loading...')}
</div>
</div> Please let me know for any further details, and accept the answer if it solved the problem. Ahmed
... View more
09-30-2022
05:31 AM
The problem with this solution is that all Admins have the capability "can_own_notable_events" and they appear in the list among SOC analysts. The woraround I found is to disable "es_notable_events" in Lookup definitions page, and edit the kv-store lookup "notable_owners" by the app "Splunk App for Lookup File Editing". The impact of this solution is that newly added SOC members need to be added manually to the "notable_owners" lookup.
... View more
09-30-2022
04:31 AM
1 Karma
Hi Everyone, I found a workaround to auto-refresh Incident Review dashboard by adding these 3 lines below to this html file as it is already included in Incident Review dashboard xml file. /opt/splunk/etc/apps/SA-ThreatIntelligence/appserver/templates/generic.html <head> <meta http-equiv="refresh" content="300"> </head> This will refresh the page after 300 seconds (5 mins). <%inherit file="base.html"/>
<head>
<meta http-equiv="refresh" content="300">
</head>
<div class="preload">
<div id="placeholder-splunk-bar">
<a href="${make_url([])}" class="brand" title="splunk > listen to your data">splunk<strong>></strong></a>
</div>
<div id="placeholder-app-bar"></div>
<div id="placeholder-main-section-body">
${_('Loading...')}
</div>
</div> Please let me know for any further details, and accept the answer if it solved the problem. Ahmed
... View more
09-26-2022
02:44 AM
Please check this Re: How to change the event time of ES Incident Re... - Splunk Community
... View more
09-16-2022
06:23 AM
1 Karma
I had the same problem and I managed to find a workaround by creating a new calculated filed for stash sourcetype with the time format I want. (strftime(_time,"%d/%m/%Y %H:%M:%S")) Then you can add NewTime filed to Incident Review dashboard.
... View more
- Tags:
- incident review time
09-13-2022
12:30 PM
I think that was possible at 2017 😊 Now there is an automatically generated js file here ./apps/SA-ThreatIntelligence/appserver/static/build/pages/incident_review.js
... View more
09-13-2022
05:42 AM
Hi,
I'd like to change Notable Event row color or the color of any field in incident review dashboard to easily identify certain events.
I played with "Advanced Edit" by setting display.visualizations.charting.fieldColors with no success as per the attached screen shot.
Ahmed
... View more
- Tags:
- colors
Labels
- Labels:
-
incident review
-
notable event
08-26-2019
06:39 AM
I had a similar issue but with a newer version, at the end it turned out to be that there is a parameter in estreamer.conf called batchsize, to control the size of log batches sent to indexers, so if you have intrusion events enabled and batchsize is set to 100, then you have to wait until you have 100 intrusions events to see them on Splunk :).
to disable this feature:
"batchSize": 1
ref.
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSplunkOperationsGuide_354.html
... View more
07-01-2019
05:38 AM
Hello Splunkers,
I have an issue to connect to Oracle database using Active Directory credentials (Kerberos Autentication).
Connection from Splunk DB connect to Oracle database is working fine in case of using local account created on the database.
Trying to authenticate with AD credentials I got this error:
Internal server error, originalErrorMessage=ORA-28274: No ORACLE password attribute corresponding to user nickname exists.
Thanks in advance
... View more
07-01-2019
05:25 AM
@alanos I am wondering if you managed to find a solution for this issue.
... View more
08-20-2018
01:25 AM
Welcome, sorry I don't have more details ..
... View more
08-20-2018
12:38 AM
/opt/splunk/bin/splunk search '| rest /services/search/jobs'
... View more
08-17-2018
02:08 AM
1 Karma
Add keepevicted=true to your query:
sourcetype="cisco:esa:textmail" | transaction internal_message_id keepevicted=true | search "My_email_address@address.com"
If you run a query that will generates a lot of events without it you will find a green exclamation mark beside "job" with this message:
Some transactions have been discarded. To include them, add keepevicted=true to your transaction command.
... View more
08-17-2018
01:47 AM
If you are checking this question at 2018 like me 🙂 then this can be done easily, Settings -> Server settings -> Email settings -> PDF Report Settings
... View more
08-17-2018
01:46 AM
If you are checking this question at 2018 like me 🙂 then this can be done easily, Settings -> Server settings -> Email settings -> PDF Report Settings
... View more
05-31-2018
06:50 AM
Issue is identified.
Splunk version 6.5.1
On incident_posture.xml page refresh option is changed.
Alert Manager 2.2.2
<option name="refresh">5m</option>
Alert Manager 2.1.4
<option name="refresh.auto.interval">300</option>
... View more
05-04-2018
08:25 AM
Incident Posture Auto-Refresh stop working after upgrade to version 2.2.2 from 2.1.4 any ideas what is needed to be modified.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-16-2023
10:37 AM
|
Karma from
