Hello everyone, I am trying to follow this guide https://research.splunk.com/endpoint/ceaed840-56b3-4a70-b8e1-d762b1c5c08c/ and I created the macros that this guide is referencing, but I am unable to create the macro for windows_rdp_connection_successful_filter, because I am unsure how to create an empty macro in Splunk web. The guide says "windows_rdp_connection_successful_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL." What does this even mean? We are currently using Splunk Enterprise 9.0.5 ... View more

Hello everyone,  I am trying to configure splunk security essentials, but it is completely blank. When I click on Data Inventory the whole page is completely blank with only the title "Data Inventory" showing. Has anyone come across this before or might know how to troubleshoot it? I have tried updating the app, but that didn't do anything.  ... View more

Hello,  I wanted to ask if there was a way I can delete reports created by Enterprise Security? There are reports created by Enterprise Security that we will never use, and i would just like to clean up the reports menu.  ... View more

Hello everyone,  I was updating our licenses and I am still new to Splunk, so I accidentally deleted the auto_generated_pool. I recreated the pool to match the auto_generated_one, but I would just like to know if I might have broken anything or if there is anyway to get Splunk to generate another auto_generated_pool? I checked our indexers and I performed a few searches and it looks like we are still gathering data.  ... View more

Hello everyone, I have a simple question. From some of the training I took, I was told that "Volume used today" resets at midnight? Is this true or is this false? ... View more