Not exactly. However, in the docs, there's a list of variables that can be used: https://docs.splunk.com/Documentation/Splunk/Latest/Alert/EmailNotificationTokens You could edit some conf files to create a new variable. Or you might be able to find something you can use with $job.latestTime$ or $result.fieldname$ ... View more

Your query should have worked.. i.e. index= firewall NOT [|inputlookup whitelist.csv | fields signature,source,destination] But please ensure your data in index=firewall contains precisely the fields signature, source, destination (The field names are case-sensitive too) and contains ALL of the fields in each Event. If a single field is missing, you will get empty results. to debug this, do the fields individually, and test if each of the field works. something like below and test for each field index= firewall NOT [|inputlookup whitelist.csv | fields signature] .. ... View more

You can see the running Configs via REST, but not the on disk configs, for the On disk configs you would need to create a custom search command that would call Btool. There have been a few written do to that, REST: | rest splunk_server=local /services/configs/conf-props | transpose Splunk_server can be any sever conf-props gets your props, conf-transforms gets you transforms conf-inputs gets you inputs conf-server gets you server..... etc Here is the Splunk Base app for Btool as well https://splunkbase.splunk.com/app/4182/#/overview ... View more

You can change the status by going to Associations in the incident review and click on edit selected. ... View more

Hi, There is no common field in both the indexes. ... View more

You don't have to use the join command. Have you tried using the query I stated above? If you add the count command, you should get exactly the result you want. index=firewall log_subtype="vulnerability" severity="informational" | search [ inputlookup PRIVATE_IP.csv ] | stats count by src_ip ... View more

Are you logging in as 'admin' or any other user? if its not admin, you need to make sure your role/user has required capabilities. ... View more