×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Dharmesh_93
Loves-to-Learn Lots
Member since: ‎11-11-2020
‎11-23-2021
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-11-2020
View All

Re: if I close one of the incident in Servicenow, ...

by in Alerting
‎10-28-2021 12:43 AM
‎10-28-2021 12:43 AM
@sag5757  The following steps ensure a unique correlation ID is created every time a new alert is triggered: 1) Append this query into the search portion of the alert action: | eval unique_id= random() + now() 2) After that, navigate to Alert Action > Correlation ID > and put this for the value: $result.unique_id$ 3) Save the Alert Action. By having a new, unique Correlation ID each time, a new incident should be created. If you want to update the same incident, then make sure that the correlation ID which you are passing from Splunk should be same as ServiceNow ticket update works mainly with the correlation ID ... View more

No results from scheduled jobs or searches

by in Splunk Enterprise Security
‎10-25-2021 11:44 PM
‎10-25-2021 11:44 PM
Hi, We are using Splunk cloud 8.2 and mainly utilizing for Splunk SIEM solution.  Currently we have many scheduled alerts, searches and reports. In the recent days we could see 21% of the searches were skipped and job execution time also increased.  From yesterday, we are unable to see output results for any of the jobs, but we are getting the search result when we execute adhoc search. We are also able to see below Errors and warnings in our console. The percentage of non high priority searches skipped (74%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=7056. Total skipped Searches=5271 The instance is approaching the maximum number of historical searches that can be run concurrently. The number of extremely lagged searches (1) over the last hour exceeded the red threshold (1) on this Splunk instance Could you please share some solution to implement in this case.      ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-23-2021 05:41 AM