Hello, I've search around and haven't found an answer on Splunk answers so maybe someone can help answer or give me a link with answer. Thanks Scenario: I've scheduled an alert to report on web-based attacks to a specific website (it's a temp fix until we can get it moved behind F5). The cron is set to run every 24hrs at 8am. My trigger is set 'for each result' because I want the alerts separated when they fire. Triggering is suppressed for 24hrs to prevent alerting on event values with identical fields. Trigger action is set to email. Challenge: Inbox overflowing with individual alerts. Rather than to receive an individual email for each result within the last 24 hr period, I'd like to receive one email with all of those matching events related to the one alert at 8 am. To be very clear, I want all of the alerts that come in (currently like almost 200 a day) to be on one email. I don't want 200 individual emails. Thanks in advance! ... View more

I can see where we can create 'New Investigations', track or manage current investigations, delete or edit or remove existing investigations, but nothing to close the investigation. When you actually go into one of your investigations there is additionally a button to 'Create New Entry' that drops down to create a 'Note' or view 'Action History' (all cool features btw), but nothing to say ok "this event or this investigation is resolved or closed". Splunk Version 6.4.1.2 App: ES Version 4.2.0 Thanks! ... View more

If this has already been covered, please provide a link, but I haven't seen anything. My organization uses Splunk Cloud and we have Enterprise Security installed. Does anyone know if there is a way to configure a search to identify when there is already an existing created notable event? As we identify things of interest or things that we'd like to pursue on a day-to-day basis in our logs, we'd like to prevent multiple investigations of the same targets and would like to configure a search to include or exclude those events. Thanks! ... View more