hello dear splunkers i have a small question about the aws app. in the security tab there are some views that uses custom commands such as "command_nadefault.py" or "command_acl_inputlookup.py"...i wanted to know or if it's possible to ask what's their use in the different dashboards that available in the app...i'm not that familiar with python so i'm not able to understand how they being used in the app. thanks in advance,  etai 🙂 ... View more

Hello guys, i'm working with a costumer which wants to replace arcsight with splunk. we're moving some systems from the arcsight and while we added "Fireglass" (by symantec) to monitoring we saw extreme growth in the license which almost caused to violations. while digging in at the logs we saw that some sites, like youtube takes something like 1000 events for time frame of 1 minute. looking deeper i could see that all the video\audio traffic was sent as well. the customer told me that in Arcsight there's an option for "aggregation and filtration", which he can take the number of logs which are the same and merge them as one event, and ingest the whole traffic. here's an explanation about the operation from the Arcsight side: ArcSight. Optimizing EPS (Aggregation and Filtration) - SOC Prime my question: can i make something like this with splunk? with a license of 100G the fireglass takes like 60G. thanks in advance  Etai 🙂 ... View more