We have indexers and Universal Forwarders and no Heavy Forwarders in use, i know UF cannot send parsed data to any external system it can only send uncooked data and all of them , but can the indexers send the parsed logs(only specific e.g. from windows index) to external system, maybe through REST API or syslog or any other mechanism? the sequence would be like this : UF>>Indexers>>External System. ... View more

I have a correlation search where 'dest' field is present, and in drilldown search I have mentioned      | search dest="$dest$"     however when i click on contributing events and the drill down search opens up with same query      | search dest="$dest$"      instead of the actual value of the 'dest' field, why doesn't this work? Anyone faced this issue? ... View more

On Splunk 7.3.1.1 and now suddenly out of nowhere this issue popped up, the notable alerts are being duplicated for almost 80% of my co relation searches, when i check the raw events for those duplicates they're exactly same, so no question of duplicity of actual logs, but only for the notable alerts that are generated in Incident Review Dashboard of Enterprise Security. Does anyone faced this issue or have resolved it? @woodcock  ... View more

I am trying to create a query using tstats from datamodel Malware, one of the sourcetype 'abc'  that i want to include is coming up in index search but not in datamodel tstats search, the index is already mapped with Malware datamodel, is this possible? ... View more