GitHub link should work. See previous message. ... View more

https://splunkbase.splunk.com/app/1724/ how about this? ... View more

See the link below which has complete documentation for a full Splunk installation to localhost. https://splunk.github.io/splunk-ansible/EXAMPLES.html#provision-local-standalone ... View more

Splunk can set the search period. Are you making summaries regularly? Isn't it the same to search for a summary 5 minutes ago after 5 minutes? ... View more

Hi @gozdeyildiz, please try something like this (if the field is called IP in every index: index=* [ search index=firewall name="malicious IP" | fields IP ] | ... If you cannot be sure that IP field has the same name in every index, you could try something like this: index=* [ search index=firewall name="malicious IP" | rename IP AS query | fields query ] | ... In both the searches check if the number of results of subsearch is more or less than 50,000, because there's this limit in subsearches. Ciao. Giuseppe ... View more

Hi gozdeyildiz, try something like this: index=my_index assigned_user=* | lookup my_lookup.csv src_ip AS assigned_ip OUTPUT username | search NOT assigned_user=username | dedup assigned_ip assigned_user | table assigned_ip assigned_user username Ciao. Giuseppe ... View more