Hello everyone, We have recently started using ES8 with Mission Control and we would like to use Mission Control's API to export information. With the help of a POSTMAN, if we try to retrieve information from an investigation with https://SPLUNK:8089/servicesNS/nobody/missioncontrol/v1/incidents/ES-00001, we get the information. Now in SPLUNK, if we pass the request | rest /servicesNS/nobody/missioncontrol, we get an answer. However, if we try | rest /servicesNS/nobody/missioncontrol/v1/incidents/ES-00001, we don't get an error message but 0 result. My user has admin rights. Does anyone have any idea why? Did we miss something? Thank you for the help!!! ... View more

Hello everyone I want to calculate the network address from an IP and a mask: IP = 192.168.1.10 Mask = 255.255.255.0 Desired result = 192.168.1.0 Unfortunately I can't find a function or method to do this. I looked for the 'cidrmatch' function but it only seems to return a boolean. Is there another way? Thanks for your help! ... View more

Hello community! I'm looking for a way to optimize this search below and I need some help :   index="oswinsec" source="XmlWinEventLog:Security" TargetUserName Kerberos earliest=-5min | regex TargetUserName="^([a-z]+)\.([a-z]+)" | regex IpAddress="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" | eval Octet1=mvindex(split(IpAddress,"."), 0) | eval Octet2=mvindex(split(IpAddress,"."), 1) | eval Octet3=mvindex(split(IpAddress,"."), 2) | where (Octet1=10 AND Octet2=244 AND Octet3>=192 AND Octet3<=255) OR (Octet1=172 AND Octet2=24) | dedup TargetUserName | table TargetUserName IpAddress     Thanking you!! regards ... View more