About rkoster

johnhuang · ‎10-05-2022

This issue was discussed a while back and the consensus is that it's a bug introduced on 8.2.x+ https://community.splunk.com/t5/Splunk-Search/Multivalue-field-which-contains-the-string-quot-data-quot-cause/m-p/574649

smoir_splunk · ‎09-24-2018

Follow these instructions and it will work for you! http://docs.splunk.com/Documentation/ES/5.1.1/Admin/Customizemenubar#Add_a_link_to_a_filtered_view_of_Incident_Review You'll have to update the navigation to point to the new view of incident review after you construct it, but this is the best solution for your use case.

woodcock · ‎04-29-2016

Take a look at this Q&A for a solution that you should be able to modify to fit: https://answers.splunk.com/answers/386488/regex-in-lookuptable.html#answer-387536

rkoster · ‎07-13-2016

Review the permissions on the Macro; ensure that it is shared and has the appropriate Read access configured.

Posts	7
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎04-08-2016

Online Status	Offline
Date Last Visited	‎10-05-2022 04:39 PM

Why does the split function fail for list_split_fa...

A search that makes searches and executes them

Re: Why does the split function fail for list_spli...

Re: In the Splunk Enterprise Security Incident Rev...

Re: A search that makes searches and executes them

Re: Why I cannot save a search containing a macro?

Join the Conversation