query to find out activity towards a particular URL eg: URL - https://www.microsoft.com/en-us/security ... View more

Error in 'SearchParser': The search specifies a macro 'summariesonly' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information. How to enable the macro 'summariesonly'? ... View more

| datamodel "Change_Analysis" "Account_Management" search | where 'All_Changes.tag'="delete" AND 'All_Changes.user'!="*$*" | stats values(All_Changes.result) as "signature",values(All_Changes.src) as "src",values(All_Changes.dest) as "dest", values(All_Changes.user) as "users", DC(All_Changes.user) as user_count by "All_Changes.Account_Management.src_user" | rename "All_Changes.Account_Management.src_user" as "src_user","All_Changes.user" as "user"   I am using this query to monitor  for Account Deleted-  But all the time I am getting this alert triggered for the computer account ending with $ symbol  Ex:  XYZLAPTOP$ , ABCLAPTOP$  etc I have added the search  where 'All_Changes.tag'="delete" AND 'All_Changes.user'!="*$*"" How can I exclude this $ symbol account from the report? Can any one please help       ... View more

If you look at the picture I cant see the real time alert option, Could you please assist me to get this on my splunk ? ... View more

The default page needs to be changed, after login to Splunk I should be directed to all the triggered alert page.  Eg: below are the triggered alert, After login I should be able to see the alert which is triggered with time seviarity and other common information and after analyzing I should be able to close the triggered alert. Can any one please guide me on this ?   ... View more

I want to change the default page to an alerting page after login. ... View more