Glad to know the issue is resolved, please accept the solution - so it's marked as Resolved. ... View more

Hello @avoelk, Alert throttling should help here? Doc - https://docs.splunk.com/Documentation/Splunk/9.3.2/Alert/ThrottleAlerts. If not alert throttling, you can also dump the results in a lookup / summary index and exclude the events in the consuquitive runs. Please let me know if any questions.   Please hit Karma, if this helps! ... View more

Hello @shivprasad Can you please have a check on below list -  1. Validate Splunk Service is Running - ./splunk status 2. Confirm for which range of IP addresses, port 8000 is Open 3. Validate If you’re using a VPC, ensure there’s an Internet Gateway attached and the route table includes a route for 0.0.0.0/0 pointing to the Internet Gateway 4. Try restarting Splunk service once - ./splunk restart   Also, Can you please confirm if there are any ERROR / WARN messages under - "/opt/splunk/var/log/splunk/splunkd.log" (Use tail command to validate) ... View more

Can you check if below works -    <form version="1.1" theme="light"> <label>Time Picker Input</label> <description>Replicate time picker issue</description> <fieldset submitButton="false"> <input type="dropdown" token="item" searchWhenChanged="true"> <label>Select Item</label> <choice value="table1">TABLE-1</choice> <choice value="table2">TABLE-2</choice> <choice value="table3">TABLE-3</choice> <change> <condition value="table1"> <set token="tab1">"Table1"</set> <unset token="tab2"></unset> <unset token="tab3"></unset> </condition> <condition value="table2"> <set token="tab2">"Table2"</set> <unset token="tab1"></unset> <unset token="tab3"></unset> </condition> <condition value="table3"> <set token="tab3">"Table3"</set> <unset token="tab1"></unset> <unset token="tab2"></unset> </condition> <condition> <unset token="tab1"></unset> <unset token="tab2"></unset> <unset token="tab3"></unset> </condition> </change> </input> <input type="time" token="time" searchWhenChanged="true"> <label>Select Time</label> <change> <set token="is_time_selected">true</set> </change> </input> </fieldset> <row depends="$tab1$ $is_time_selected$"> <panel> <table> <title>Table1</title> <search> <query> | makeresults | eval Table = "Table1" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row depends="$tab2$ $is_time_selected$"> <panel> <table> <title>Table2</title> <search> <query> | makeresults | eval Table = "Table2" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row depends="$tab3$ $is_time_selected$"> <panel> <table> <title>Table3</title> <search> <query> | makeresults | eval Table = "Table3" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   Please hit Karma, if this helps!   ... View more

Hello @Kenny_splunk we would need to call individual rest endpoints and append results. Like, /data/props, /data/transforms. Did a quick ChatGPT and found below search -  | rest /servicesNS/-/<app_name>/data/props | append [| rest /servicesNS/-/<app_name>/data/transforms] | append [| rest /servicesNS/-/<app_name>/data/macros] | append [| rest /servicesNS/-/<app_name>/saved/searches] | append [| rest /servicesNS/-/<app_name>/data/ui/views] | append [| rest /servicesNS/-/<app_name>/data/ui/nav] | append [| rest /servicesNS/-/<app_name>/data/ui/manager] | append [| rest /servicesNS/-/<app_name>/data/ui/panels] | append [| rest /servicesNS/-/<app_name>/data/collections/config] | fields title, eai:acl.owner, eai:acl.app, eai:acl.sharing | search eai:acl.app="<app_name>" | table title, eai:acl.owner, eai:acl.sharing | sort eai:acl.owner, title    Replace <app_name> with specific app name (like search).   Please hit Karma, if this helps! ... View more

Along with what @SanjayReddy shared, https://www.splunk.com/en_us/training/certification.html would also help to look over different certifications (individual links have respective prerequisites. ... View more

Hello @uagraw01, I believe below should work -  props.conf -  [<sourcetype>] TRANSFORMS-add_fields = add_additional_field transforms.conf -  [add_additional_field] REGEX = .* FORMAT = ServerName::mobiwick ServerIP::10.30.xx.56.78 WRITE_META = true   The above will add additional 2 fields in the events.  Note that, it will not update the _raw events. Please accept the solution and hit Karma, if this helps! ... View more

Along with what @richgalloway suggested (Splunk Security Essentials / SSE), I would also go for Splunk ES Content Update (ESCU, https://splunkbase.splunk.com/app/3449) The analytic stories and their searches are also available at - https://github.com/splunk/security_content   Please hit Karma, if this helps! ... View more

Hello @Raphy AFAIK, there's no default method which mandates having owner assigned while closing the notable event. That being said, you can do either of following -  1. Have a default owner assigned - https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-it-possible-to-auto-assign-notables-in-Enterprise-Security 2. Schedule a search which periodically give you list of notable where owner is not assigned -  | inputlookup incident_review_lookup | where status="Closed" AND isnull(owner)   Please accept the solution and hit Karma, if this helps! ... View more

More often than not it would be because of the default macro not being updated - which has information about "in which index the data resides". As @Bhumi suggested, can you share the name of the TA to assist you more? ... View more

Hello @zksvc Was the notable created after you updated the next actions - or was it already generated and later you updated the Correlation Search? ... View more

Hello @grep, Can you please try removing whitelisting from the "CIM Setup" page and only have condition available from Macro page? Let me know if it doesn't work and I can troubleshoot. ... View more

You can use addtotals as below -  | addtotals col=t row=f labelfield=index label="Overall Total"   Please accept the solution and hit Karma, if this helps! ... View more

This one have always help with all Azure onboarding questions, want to give it a try? - https://jasonconger.com/splunk-azure-gdi/ Reference -  https://www.splunk.com/en_us/blog/tips-and-tricks/getting-microsoft-azure-data-into-splunk.html?locale=en_us     ... View more

Not sure if https://splunkbase.splunk.com/app/1761 helps? ... View more

Hello @yuvaraj_m91  Can you please elaborate the question a bit? ... View more

Hello @heskez Yes it's possible. You can have a custom lookup popped-up and integrate the same local intel - https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Addlocalthreatintel   Please hit Karma, if this helps! ... View more

Hello @splunky_diamond, As stated by 2 folks, resource consumption depends on multiple factors. If you are planning to enable ~15 use cases in ES for learning purpose with all-in-one test environment, 32 GB RAM, 32 vCPU, and 200 GB hard disk should be enough. Base configuration for ES is as below -  https://docs.splunk.com/Documentation/ES/7.3.1/Install/DeploymentPlanning ... View more

Better to raise Splunk Support case for better troubleshooting 🙂 ... View more

Hello @dc18, have you checked https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatch and searched for EC2 on the page? ... View more

+1 with @TheLawsOfChaos, It's a common practise to create a Role with "Read Only" permission. You have any further questions / issues with respect to this @treven? ... View more

Hello @493600, There is no OOTB of achieving this. Usually, we have to download the events in _raw format, upload it on a test environment which has latest version of TA along with CIM Validator installed - and validate the field extraction. Commands like fieldsummary can help in comparing the field name and values - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldsummary   Please accept the solution and hit Karma, if this helps! ... View more

Hello @matoulas Can you please elaborate the question? One liner isn't seems to define the actual problem 🙂 ... View more

Let me agree with your disagreement 🙂 Do you agree with the answer though is the question - The 4 points mentioned initially to centrally get the events on a single server and monitor the same? ... View more