Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About CSmoke
CSmoke
Path Finder
Member since:
02-08-2015
09-25-2023
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 22 |
| Karma Received | 3 |
| Member Since | 02-08-2015 |
Activity Feed
- Got Karma for Re: Error installing Splunk IT Essentials Work- Anyone encountered this error and managed to install IT Essentials Work?. 09-25-2023 05:32 AM
- Posted Re: Error installing Splunk IT Essentials Work- Anyone encountered this error and managed to install IT Essentials Work? on All Apps and Add-ons. 09-25-2023 04:13 AM
- Karma Re: Error installing Splunk IT Essentials Work- Anyone encountered this error and managed to install IT Essentials Work? for richgalloway. 09-25-2023 04:10 AM
- Karma Re: Splunk local account login to splunkweb when SAML authentication is enabled? for suarezry. 08-25-2023 02:00 AM
- Karma Re: Is there any way to list all the saved searches in Splunk? for vasanthmss. 07-06-2023 04:04 AM
- Karma Re: Splunk draw.io icon library for emzet. 07-26-2022 07:07 AM
- Posted Re: Splunk cannot authenticate the request. CSRF validation failed. on Splunk Enterprise. 07-13-2021 04:55 AM
- Posted Re: Phantom APPs can not be set. on All Apps and Add-ons. 01-29-2021 03:16 AM
- Karma Re: Phantom APPs can not be set. for shozawa. 01-29-2021 03:14 AM
- Got Karma for Re: FS-ISAC Feeds Not Showing in Threat Artifacts. 11-01-2020 04:56 AM
- Karma Help with Splunk ES Investigations Collaborators for mbouchersops. 06-05-2020 12:50 AM
- Karma Is there a way to add entire roles as collaborators to an investigation rather than just one at a time? for jadamsplunk. 06-05-2020 12:49 AM
- Karma Throttle unless count increases for tracegordon. 06-05-2020 12:49 AM
- Karma Re: How can i change the default 8000 port where splunk web interface get installed? for deepashri_123. 06-05-2020 12:49 AM
- Got Karma for Is Extreme Search still available?. 06-05-2020 12:49 AM
- Karma Re: Splunk.License: failed to add because: cannot add lic w/ subgroupId=DevTest:xxxxx@xxxx.com to stack w/ subgroupId=Production for scottyau. 06-05-2020 12:48 AM
- Karma Re: How to search a lookup table or file by the column that has timestamp for wtaylor149. 06-05-2020 12:48 AM
- Karma Re: How can I limit the results of a stats values() function? for pj. 06-05-2020 12:48 AM
- Karma Re: Splunk Enterprise Security: How to add domains to Threat list to be searched anywhere in URL? for jstoner_splunk. 06-05-2020 12:48 AM
- Karma How can non-admin users share content across apps globally? for jander476. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
09-25-2023
04:13 AM
1 Karma
I received the same error. On Windows, I unzipped with 7-zip, copied the file to \etc\apps, restarted Splunk. App seems to work correctly.
... View more
07-13-2021
04:55 AM
Thanks. Did not want to clear everything, so tried in-private mode which also seemed to let me complete ES install.
... View more
01-29-2021
03:16 AM
Thanks, this worked for me. Had to add stanza, as it was not in default\phantom.conf [verify_certs] value = false
... View more
12-16-2019
09:51 AM
1 Karma
Something like the following should allow you to see the indicators in the various KV Stores, you can replace edge*xml
with something like *fs_isac as long as that is included in the name of the threat download you created
| inputlookup file_intel
| append [ inputlookup ip_intel ]
| append [ inputlookup http_intel ]
| search threat_key=*edge*xml
| eval time=strftime(time,"%F %T")
... View more
06-04-2019
01:06 PM
My post was more of a feature request than a question. It is something I would like Splunk to add.
... View more
06-03-2019
06:33 AM
When viewing notable events on the Incident Review Dashboard, there is a link named Correlation Search.
The link opens the standard screen to edit the search.
Would it be possible to add the magnifying glass icon next to this link so that users can open the search without cutting and pasting the query?
... View more
01-31-2019
11:12 AM
Thanks, that makes sense.
... View more
01-31-2019
08:41 AM
Looking at some of the built in dashboards in Enterprise Security, there is a macro named useother
| tstats count from datamodel=Web.Web where * by _time,Web.status span=10m | timechart minspan=10m useother= useother count by Web.status | drop_dm_object_name("Web")
It appears to set the value to true.
title = useother
args = none
definition = true
Can anyone explain why this is used instead of useother=true?
... View more
08-03-2018
07:17 AM
Thanks, this worked for me!
... View more
03-09-2018
08:30 AM
1 Karma
I no longer see Extreme Search on Splunkbase.
Is it part of Splunk or Enterprise Security? (We are a few version behind)
Or has it been removed/deprecated or possible under another name?
... View more
10-10-2017
09:41 AM
I believe this is what you are looking for
form.source
Display notable events created by the correlation search specified by this parameter. HTML-encode spaces in the correlation search name and use the name that appears in the notable event rather than the name that appears on Content Management. Endpoint - Host With Multiple Infections - Rule form.source=Endpoint%20-%20Host%20With%20Multiple%20Infections%20-%20Rule
http://docs.splunk.com/Documentation/ES/4.7.2/Admin/Customizemenubar#Add_a_link_to_a_filtered_view_of_Incident_Review
... View more
10-10-2017
04:15 AM
Thanks, the search does exactly what I needed.
... View more
01-23-2017
06:09 AM
|inputlookup incident_review_lookup | eval _time=time | where _time >= relative_time(now(), "-2h@h")
this worked for me, thanks!
... View more
02-11-2015
04:30 PM
Check out http://hailataxii.com/
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-25-2023
09:03 AM
|
