Thanks for the answer @livehybrid. With respect to - "Yes two different deployments can be fed. search clients for eachother"? - Have you seen an environment with the same? Because I couldn't find any of the Splunk Doc where it's mentioned that the environments can be interconnected. ... View more

No, bucket size should be fine - just need to play around with 3 DMA parameters only -  1. Backfill Range 2. Max Concurrent Searches 3. Max Summarization Search Time So, the strategy I suggested previously was - "build short, build often". Check the attached file. The boxes in the Yellow are default - where with Max Concurrent Searches with 3 and Max Search Time as 3600, the 4th concurrent search will only start once 1st is completed (after 3600) - which is happening in your case. However, we can go with the other approach - in green - where with 4 concurrent searches and Max Search Time as 1200 - we can build the summaries faster - which will also respect the recent event faster. Please let me if any questions (and how the configuration changes goes!) ... View more

Are you using the default acceleration parameters? If so, can you try having Max Concurrent Searches as 4 (instead of 3), Max Summarization Search time as 15 Mins (instead of 60), Lower the backfill range (if you are sure that there are no major historical events we need to take care about). I faced the similar issue for a large (40 TB+ a day) customer, and had to tweak those parameters for Network_Traffic and couple of other Data Models. Reference Doc - https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.3/use-data-summaries-to-accelerate-searches/accelerate-data-models#ariaid-title10   ... View more

Yes, this is right. There's no copy/pasting. We may need to update some parameters to support larger upload, but apart from that we can simply upload the ES package from the UI, perform the setup and deploy the Bundle. ... View more

Hello @dataisbeautiful, You can just add the other field name afte the by clause? can you give the current search which you are using and confirm if the ID field that you want to add is in the events itself? ... View more

A couple of things -  Can you confirm there's no event suppression rule? Can you confirm the time range are exactly the same and not being rounded off (for example if it's 24 hours, it's same in both and not rounded off) Can you confirm the result count difference between index=notable VS `notable` (notable macro) and what's the count difference? ... View more

On top of what @kiran_panchavat mentioned, once we generate the Short IDs, we can also add in Incident Review Dashboard as a custom field - https://www.splunk.com/en_us/blog/security/modifying-the-incident-review-page.html#:~:text=To%20configure%20Incident%20Review%20and,see%20Incident%20Review%20%E2%80%93%20Event%20Attributes. ... View more

Hello @KKuser Have you tried adding the events in the Investigation? - https://docs.splunk.com/Documentation/ES/8.0.2/User/StartInvestigation You can add multiple notable events in Investigation and write down notes as well. Also, if you want to create Notable events from any raw event, you can simply click on Edit Event and Create Notable event right from the search. Please let me know if you have any questions on the same. ... View more

Did you go through the above response and have follow-up questions? ... View more

@AShwin1119 Did you went through the response and have any further questions? ... View more

The question seems not to provide all the information (or at least I am unable to understand). Would you please elaborate more? ... View more

Hello @AShwin1119 Would you be able to confirm why we need to have props / transforms configuration? As far as I understand, we can just have default _TCP_ROUTING configured to send all SH events to Indexers through outputs configurations - isn't it? Ref Doc - https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata ... View more

So if I understand this correctly in simple terms - you want to get notified whenever there's a notable event with certain urgency? If so, do you want to get notified via Email? We can use Notable macro (`notable`) in order to get the notable details along with urgency and use fields like source and urgency - in order to get the specific result. ... View more

Yes, search for "_intel" in Lookup Definition and you will see all Threat Intel Lookup along with definition -  All lookups from the specific categories gets combined / merged and used to Threat Matching. For example, everything related to IP will fall under ip_intel lookup.  Please hit Karma, if this helps! ... View more

Glad to know the issue is resolved, please accept the solution - so it's marked as Resolved. ... View more

Hello @avoelk, Alert throttling should help here? Doc - https://docs.splunk.com/Documentation/Splunk/9.3.2/Alert/ThrottleAlerts. If not alert throttling, you can also dump the results in a lookup / summary index and exclude the events in the consuquitive runs. Please let me know if any questions.   Please hit Karma, if this helps! ... View more

Hello @shivprasad Can you please have a check on below list -  1. Validate Splunk Service is Running - ./splunk status 2. Confirm for which range of IP addresses, port 8000 is Open 3. Validate If you’re using a VPC, ensure there’s an Internet Gateway attached and the route table includes a route for 0.0.0.0/0 pointing to the Internet Gateway 4. Try restarting Splunk service once - ./splunk restart   Also, Can you please confirm if there are any ERROR / WARN messages under - "/opt/splunk/var/log/splunk/splunkd.log" (Use tail command to validate) ... View more

Can you check if below works -    <form version="1.1" theme="light"> <label>Time Picker Input</label> <description>Replicate time picker issue</description> <fieldset submitButton="false"> <input type="dropdown" token="item" searchWhenChanged="true"> <label>Select Item</label> <choice value="table1">TABLE-1</choice> <choice value="table2">TABLE-2</choice> <choice value="table3">TABLE-3</choice> <change> <condition value="table1"> <set token="tab1">"Table1"</set> <unset token="tab2"></unset> <unset token="tab3"></unset> </condition> <condition value="table2"> <set token="tab2">"Table2"</set> <unset token="tab1"></unset> <unset token="tab3"></unset> </condition> <condition value="table3"> <set token="tab3">"Table3"</set> <unset token="tab1"></unset> <unset token="tab2"></unset> </condition> <condition> <unset token="tab1"></unset> <unset token="tab2"></unset> <unset token="tab3"></unset> </condition> </change> </input> <input type="time" token="time" searchWhenChanged="true"> <label>Select Time</label> <change> <set token="is_time_selected">true</set> </change> </input> </fieldset> <row depends="$tab1$ $is_time_selected$"> <panel> <table> <title>Table1</title> <search> <query> | makeresults | eval Table = "Table1" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row depends="$tab2$ $is_time_selected$"> <panel> <table> <title>Table2</title> <search> <query> | makeresults | eval Table = "Table2" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row depends="$tab3$ $is_time_selected$"> <panel> <table> <title>Table3</title> <search> <query> | makeresults | eval Table = "Table3" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   Please hit Karma, if this helps!   ... View more

Hello @Kenny_splunk we would need to call individual rest endpoints and append results. Like, /data/props, /data/transforms. Did a quick ChatGPT and found below search -  | rest /servicesNS/-/<app_name>/data/props | append [| rest /servicesNS/-/<app_name>/data/transforms] | append [| rest /servicesNS/-/<app_name>/data/macros] | append [| rest /servicesNS/-/<app_name>/saved/searches] | append [| rest /servicesNS/-/<app_name>/data/ui/views] | append [| rest /servicesNS/-/<app_name>/data/ui/nav] | append [| rest /servicesNS/-/<app_name>/data/ui/manager] | append [| rest /servicesNS/-/<app_name>/data/ui/panels] | append [| rest /servicesNS/-/<app_name>/data/collections/config] | fields title, eai:acl.owner, eai:acl.app, eai:acl.sharing | search eai:acl.app="<app_name>" | table title, eai:acl.owner, eai:acl.sharing | sort eai:acl.owner, title    Replace <app_name> with specific app name (like search).   Please hit Karma, if this helps! ... View more

Along with what @SanjayReddy shared, https://www.splunk.com/en_us/training/certification.html would also help to look over different certifications (individual links have respective prerequisites. ... View more

Hello @uagraw01, I believe below should work -  props.conf -  [<sourcetype>] TRANSFORMS-add_fields = add_additional_field transforms.conf -  [add_additional_field] REGEX = .* FORMAT = ServerName::mobiwick ServerIP::10.30.xx.56.78 WRITE_META = true   The above will add additional 2 fields in the events.  Note that, it will not update the _raw events. Please accept the solution and hit Karma, if this helps! ... View more

Along with what @richgalloway suggested (Splunk Security Essentials / SSE), I would also go for Splunk ES Content Update (ESCU, https://splunkbase.splunk.com/app/3449) The analytic stories and their searches are also available at - https://github.com/splunk/security_content   Please hit Karma, if this helps! ... View more

Hello @Raphy AFAIK, there's no default method which mandates having owner assigned while closing the notable event. That being said, you can do either of following -  1. Have a default owner assigned - https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-it-possible-to-auto-assign-notables-in-Enterprise-Security 2. Schedule a search which periodically give you list of notable where owner is not assigned -  | inputlookup incident_review_lookup | where status="Closed" AND isnull(owner)   Please accept the solution and hit Karma, if this helps! ... View more