We'd like to have clickable links in our notable event descriptions so that operations analysts can be directed to detailed response plans from each notable event. Standard HTML A HREF formatting does not work. We need to be able to configure this through the Correlation Search edit panel of the Web UI. Scope is Splunk Enterprise Security 4.1. Thanks... ... View more

We have multiples lines of text in our detailed Splunk ES notable event descriptions. In order to make the text readable by our operations team, we want to manually force a newline when appropriate. Below are a few sets of newline options we have tried that do not work. Any ideas? Also note that I need to be able to change this through the edit correlation search GUI and not manual file end from the console command line. \n </p> \<\/p\> <\p> [p] ... View more

I'm looking to enrich a search of firewall IP data with DNS host data from proxy logs. To be clear, I don't want to do a DNS reverse lookup, I want to use information that is already in my proxy logs. So basically, I'm looking to enrich the output of Search 1 (firewalls_traffic) by adding a field with a value based on the results of Search 2 (proxy_logs.) Search 1: sourcetype=firewall_traffic (some criteria * ) | stats sum(bytes_sent), count(repeat_count) by src_ip,application,dst_ip | ?? Add new field with values from Search 2 ?? | sort 10 -bytes_sent Search 2: sourcetype=proxy_logs ?? dst_ip value from Search 1 ?? | fields dns_name | head 1 Thanks, Al ... View more