I want to enable risk based alerting as a part of threat hunting. Usecase- lf a malicious file is transmitted, risk score should be added by 10, if the file is triggered risk score should be updated by +20. and an alert should be triggered only if risk_score>=30. Can I accomplish it writing a correlation search?  Or there is another way of doing it, please suggest.   ... View more

I can see that we are having duplicate events in every index, query used to identify the duplicate events: index=* |eval myID=_cd |search [search index=* |streamstats count by _raw |search count>1|eval myID=_cd |fields myID ] |stats c(myID) as dpc by index Query used to get bucket details of these events: index=* | eval cd=_cd | eval bkt= _bkt | table cd bkt index splunk_server _time source host sourcetype _raw   Note: SF and RF are not met and are set to 3:3. We have multisite clustered environment. Could this issue be due to SF RF not met or somehow SH is showing up data from replicated buckets as well? Is there a fix to this? ... View more

While I am trying to set up a search head, apps for certificate, webserver and search head base config is getting deleted when I try to start Splunk service. Also, ./splunk start shows only splunk daemon is getting started and not web. Any suggestions would be highly appreciated. ... View more