Currently on Splunk ES 7.3.2 Splunk Enterprise Security  where i can see users, who used to be part of the organisation, but are now deleted/disabled (in Splunk) are still populating when i try to assign new investigations to other current members of the organisation For instance, Incident Review -> Notable -> Create Investigation In the investigation panel, when i try to assign the investigation to other members of the team, i can also see disabled/deleted accounts/users/members as an option to assign the investigation to. Any way we can remove these members from populating so that the list of investigators replicate the current numbers we have in the team. ... View more

As the title suggests, i am trying to onboard multiple data sources in Splunk UBA. I would like to see if there is a way i can see from the CLI on the EPS per each data source ingested. The EPS  fluctuates when we run data sources to ingest data from Specific time window even if the data exists within Splunk Enterprise as compared to AllTime.  ... View more

After building a project/add-on based on the Standard naming convention of Splunk, i am facing the issue where i have to remove the prefix set by the app. Renaming it via the add on builder fails and renaming it outside of the app breaks the whole app as it runs based on complex scripts within. Any guidance will be hepful ... View more