I have search result outputs as the following, tactic technique searchName Data from Information Repositories collection search Name A Valid Accounts persistence search Name B Use Alternate Authentication Material: Pass the Ticket lateral movement search Name C   and so on... I need to add a dashboard panel as shown below     Need help in the search query for my dashboard panel where the count of the number of custom searches created is displayed for every technique. ... View more

What are the different configurations made on the splunk instances to make them work like search head, indexer and a cluster master/deployment server? Share any links that has simple understanding. (instances not in distributed mode) ... View more

Hi All, I would like to get the average for Failed_Attempts and Passed_Authentications of the below table, _time Failed_Attempts Passed_Authentications 2017-10-09 12345 28800 2017-10-10 22189 47452 2017-10-11 19697 50204 2017-10-12 4124 12054 Please suggest the query !! ... View more

Hi All, I would like to find a way out for the below Cisco ISE use-case scenarios . It would be great if you can help me with the search queries, • New devices connecting to the wired network • Legacy known devices (e.g. printers) connecting from a different network port • Known devices connecting from two different network ports at the same time • Monitor logins by device type to understand unusual or rare device type authentications • Baseline successful and unsuccessful logins to identify anomalies These use-cases are for Cisco ISE Devices. Thanks in advance. ... View more

Hi, I wanted to create a user account having only access to ES-APP and within which he needs to have access to only incident review, Security Posture, Intrusion Center (present in Security domain -> Network -> Intrusion Centre) dashboards. How can this be done? ... View more

Can someone help out with a search for the below context: 1) Need to get all the public IPs having blocked traffic (with blocked log count >100 ) 2) IPs identified in step 1 should also have an allowed connection(count>1) through the firewall. Please let me know the search? This search need to be used for Palo Alto Firewall logs. Thanks in advance. ... View more

On looking into the internal logs of the server on which forwarder is configured, I could observe that splunkd is shutting down for every 24 hours, and starting again. Below are the logs before the shut down, 09-06-2016 23:15:24.658 -0700 INFO ShutdownHandler - Shutting down splunkd 09-06-2016 23:15:24.253 -0700 INFO loader - Shutdown HTTPDispatchThread 09-06-2016 23:15:24.253 -0700 INFO loader - Shutdown HTTPDispatchThread 09-06-2016 23:15:23.987 -0700 INFO PipelineComponent - Performing early shutdown tasks 09-06-2016 23:15:23.987 -0700 INFO PipelineComponent - Performing early shutdown tasks 09-06-2016 23:14:57.092 -0700 INFO TcpOutputProc - Connected to idx=172.x.x.52:9997 using ACK. 09-06-2016 23:14:56.842 -0700 INFO StatusMgr - destHost=172.x.x.52, destIp=172.x.x.52, destPort=9997, eventType=connect_done, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor Below are the logs after a restart has been done, 09-06-2016 23:16:16.829 -0700 WARN IConfCache - Stanza has an expansion [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\fmi_all_Splunk_TA_windows_inputs_installed_apps\bin\win_installed_apps.bat], ignoring alternate expansion [script://C:\Program Files\SplunkUniversalForwarder\etc\apps\fmi_all_Splunk_TA_windows_inputs\bin\win_installed_apps.bat] in inputs.conf 09-06-2016 23:16:16.720 -0700 INFO loader - Automatic migration of modular inputs 09-06-2016 23:16:16.720 -0700 INFO loader - win-service: Splunk starting as a local administrator 09-06-2016 23:16:16.704 -0700 INFO loader - win-service: Starting as a Windows service: will run various system checks first... What could be the reason for Splunkd to stop..And it is happening on a daily basis..What could be the reason behind it?? ... View more