×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Alspeedo
Engager
Member since: ‎04-25-2019
‎02-09-2021
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 2
Member Since ‎04-25-2019
View All

Removing 1 IP from a threat Intel list without re...

by in Splunk Enterprise Security
‎05-03-2019 06:36 AM
1 Karma
‎05-03-2019 06:36 AM
1 Karma
We are using Splunk es. We started porting list into the threat intel feeds. Our analyst wants to remove a single IP from this list and not suppress them. Is there a way of doing this without having to |outputlookup tabling over ip_intel? Anything will help. ... View more

Re: Is it possible to set up an alert that trigger...

by in Alerting
‎04-25-2019 02:00 PM
‎04-25-2019 02:00 PM
You can use the extract fields to create a separate field for that if you see it reoccurring in multiple events. https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/ExtractfieldsinteractivelywithIFX After you get it extracted you can create an alert when that field is greater than your number. Hope that helps. Alspeedo ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎02-09-2021 09:52 AM
Karma from
View All