@nareshkareeti try  | tstats summariesonly=true count FROM datamodel=Network_Traffic WHERE (All_Traffic.src_ip=* OR All_Traffic.dest_ip=*) BY All_Traffic.src_ip, All_Traffic.dest_ip | `drop_dm_object_name("All_Traffic")` ... View more

@GeneralBlack we might need to re-install the previous splunk version for this, best approach is to work with support. https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.3/administer-the-app-key-value-store/migrate-the-kv-store-storage-engine#Upgrade_KV_store_server_to_version_4.2 Try this go to login.splunk.com > support > support portal  > Need help? > Create a Case if this Helps, Please Upvote ... View more

@GeneralBlack Please work with splunk support, may be its missing the the mongod folder and it was not created after upgrade? ... View more

@Lien unfortunately, its not supported for the splunkcloud trial version. https://docs.splunk.com/Documentation/SplunkCloud/latest/Admin/TypesofSplunkClouddeployment       If this Helps, Please Upvote! ... View more

@ND1 It's not easy to troubleshoot without a screen share, but typically I recommend: Check the time filter on each dashboard panel Click the magnifying glass on the panel to view the search Expand the search to see what's actually running - you'll typically see macros there Expand those macros using Ctrl + Shift + E (Windows) or Cmd + Shift + E (Mac) Run the expanded search with a broader time range to see if data appears also check Time range mismatch: The ES dashboard is looking for recent data while your correlation search finds older events Data model acceleration: Your correlation search might need CIM-compliant field mappings Dashboard filters: Check if the dashboard has hidden drilldown tokens or filters applied check out this user guide: https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/analytics/available-dashboards-in-splunk-enterprise-security Additional help: If you have Splunk OnDemand Services credits available, I'd recommend using them to walk through this issue with a Splunk expert who can troubleshoot in real-time. If this Helps, Pleas Upvote. ... View more

@ND1 Most probably when an incident is not showing up, it's either suppression blocking the events or the notable action not being properly configured. 1. Check if notable events are being created: index=notable earliest=-7d | search source="*your_correlation_search_name*" 2. Check suppression settings: | rest /services/saved/searches | search title="*your_correlation_search_name*" | table title, alert.suppress, alert.suppress.period Try below: If alert.suppress=1, try disabling suppression temporarily in ES > Content Management Edit your correlation search and ensure "Notable" action is checked and saved Test your correlation search manually first to confirm it returns results If this Helps, Please Upvote.   ... View more

  I think there is no easy way because, as @richgalloway  mentioned, there is no warning when a search tries to use an index that doesn't exist. Even if you choose result_count=0, you will get a lot of false positives. The best way is to run a search against the saved searches and validate with your existing indexes. The most reliable approach is the manual two-step method: Step 1: Get scheduled searches and their referenced indexes     | rest /services/saved/searches | search disabled=0 is_scheduled=1 | rex field=search "index\s*=\s*(?<referenced_index>[^\s\|]+)" | stats values(title) as searches by referenced_index Step 2: Get your current indexes     | rest /services/data/indexes | fields title If this Helps, Please Upvote. ... View more

@Kowshik looks like Splunk Observability Cloud could not connect with AWS. Review your authentication credentials and make sure you have proper access to all the regions on the list below. us-east-1 us-east-2 us-west-1 us-west-2 https://help.splunk.com/en/splunk-observability-cloud/get-started/service-description/splunk-observability-cloud-service-description#available-regions-or-realms-0 Refer: https://help.splunk.com/en/splunk-observability-cloud/manage-data/connect-to-your-cloud-service-provider/connect-to-aws/troubleshoot-your-aws-integration#splunk-observability-cloud-doesnt-work-as-expected-0   If this Helps, Please Upvote. ... View more

@Raj_Splunk_Ing  try  | eval date_only=strftime(strptime(replace(ClintReqRcvdTime, "\s+", " "), "%a %d %b %Y %H:%M:%S :%N EDT"), "%m/%d/%Y") ... View more

Hey @Karthikeya , Yeah, this is a pretty common issue and you're on the right about concurrent searches and quotas. From what you're describing, it sounds like you're hitting some resource limits. Here's what's likely happening: Check your role-based search quotas first: Go to Settings > Access controls > Roles Look at the roles your affected users have Check their "srchDiskQuota" and "srchJobsQuota settings With 100 roles, you might have some with really restrictive limits The "no jobs showing up" thing is typical - users often can't see queued/background jobs in their job manager, especially if they're system-generated or from other sessions. Things to look at: Infrastructure capacity - Are you actually running out of search head resources? Check your monitoring console for search concurrency and resource usage Role quotas vs actual demand - Your users might need higher concurrent search limits than what their roles allow Dashboard design issues - Heavy dashboards with tons of panels and no base searches can eat up concurrent search slots fast Quick fixes to try: Temporarily increase disk quotas for affected roles (but watch your infrastructure) Have users refresh their dashboards less frequently Look for dashboards that could use base searches instead of running everything separately To see what's actually queuing up, check your internal logs for that exact message you mentioned: "The maximum number of concurrent historical searches for this user based on their role quota has been reached." Start with the role quotas - that's usually the quickest win.  refer: https://splunk.my.site.com/customer/s/article/Search-Concurrency-The-maximum-number-of-concurrent-has-been-reached If this Helps, please Upvote. ... View more

Hey @danielbb , Did you already check out the developer-supported Tenable App for Splunk? It should work with your sourcetypes: https://splunkbase.splunk.com/app/4061 Here's the docs for it: https://docs.tenable.com/integrations/Splunk/Content/Splunk2/TenableAppforSplunk.htm And there's also a full integration guide PDF that might be helpful: https://docs.tenable.com/integrations/Splunk/Content/PDF/Tenable_and_Splunk_Integration_Guide.pdf This might give you dashboards and visualizations for your Tenable.io data.  Cheers If this Helps, Please Upvote ... View more

Hey @mohsplunking , So a couple things on your setup: First, just to clarify - the UFs actually pull from the DS, not push to it. The deployment server is more like a config store that the forwarders check in with and grab their apps/configs from. And yeah, you're totally right about needing the Windows TA on your heavy forwarder. You might see data without it, but you definitely want it installed on whatever's doing the parsing - which is your HF in this case. Otherwise you'll miss out on proper field extractions and parsing. Here's the install doc: https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/Install Yes - Windows TA goes on the HF (since that's where parsing happens), and then your output app handles forwarding everything along to the indexers. Cheers If this Helps, please Upvote ... View more

@Nraj87 Please follow this: https://docs.splunk.com/Documentation/ES/7.3.3/User/Howurgencyisassigned#Modify_the_urgency_lookup_directly Modify the urgency lookup directly You can change which severity and priority values result in which calculated urgency values for notable events in Splunk Enterprise Security. Only specific values are valid for severity or priority values. Use only those values when modifying the lookup. Do not modify the names of the notable event urgency values. Valid severity values: unknown, informational, low, medium, high, critical. Valid priority values: unknown, low, medium, high, critical. Valid urgency values: informational, low, medium, high, critical. On the Enterprise Security menu bar, select Configure > Content > Content Management. Choose the Urgency Levels lookup. An editable, color coded table representing the urgency lookup file displays. In any row where the priority or severity is listed as unknown, review the assigned urgency. (Optional) Edit the table and change the urgency to another one of the accepted values. All urgency values must be lower case. Click Save. If this Helps, Please Upvote! ... View more

 @gopu  never used AppDynamics, in studio go to the json source code for each markdown. ... View more

@Gopikrishnan_Ra did you already try editing the source code and add explicit font settings like "fontSize": "medium", "fontType": "proportional" to each visualization? could be rendering issue ? What version are you on? If this helps, Please Upvote. ... View more

@LexSplunker  I think thats normal behavior not an add-on issue?. did you already try  something like this ? I always specify the attributes I need because of the  special handling and performance.     | ldapsearch search="(&(cn=*userhere*))" attrs="cn,memberOf,primaryGroupID" | eval primaryGroupName=if(primaryGroupID="513","Domain Users","Other Primary Group") refer: https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.2/User/UseSA-ldapsearchtotroubleshootproblems If this reply Helps, Please Upvote. ... View more

@Sarvesh_Fenix The first one is just an info message about the SignInDetails input status. The second one shows a CSRF  validation failure in the Splunk web interface. Did you try restart after configuring inputs?   ... View more

@smahoney In order to set a refresh, you must specify the refresh option on your search by adding "refresh: 3s" to your underlying search options to refresh every 3 seconds. REFRESH is a setting that goes with Data Sources, not Visualizations. REFRESH can be set on individual datasources or can be set as a DEFAULT for all datasources . https://docs.splunk.com/Documentation/Splunk/9.4.2/DashStudio/Default#Set_defaults_by_data_source_or_visualization_type If this Helps, Please Upvote!! ... View more

hi @Sarvesh_Fenix  The 429 error you're seeing is might be due to the  Graph throttling. Microsoft limits users to approximately 15 queries per 5-second window. Try to Increase your polling interval in the Azure add-on configuration Split your subscription monitoring into separate inputs The Resource Graph approach you're currently using will continue to hit these limits. Microsoft's documentation (https://docs.microsoft.com/en-us/azure/governance/resource-graph/concepts/guidance-for-throttled-requests) recommends implementing pagination, staggering requests, and proper retry logic. Check your Azure application permissions as well - you'll need AuditLog.Read.All and Directory.Read.All for SignIn logs. If this helps, Please Upvote ... View more

@smahoney Did you already try this option with setting a global default for refresh in the code? https://docs.splunk.com/Documentation/Splunk/9.4.2/DashStudio/Default#Use_global_defaults If this Helps, Please Upvote!! Cheers! Sai ... View more

@Travlin1 something like this?   | makeresults | eval cn=mvappend( "192_168_1_1", "10_0_0_5", "webserver-prod01", "172_16_32_1", "database.example.com", "192_168_0_badformat", "dev_server_01" ) | mvexpand cn | eval converted_host=case( match(cn, "^\d+_\d+_\d+_\d+$"), replace(cn, "_", "."), true(), cn ) | eval host_type=case( match(cn, "^\d+_\d+_\d+_\d+$"), "ip_address", true(), "hostname" ) | table cn, converted_host, host_type         If this helps, Please Upvote. ... View more