Hi this conf19 presentation shows how to find all KOs via rest api. https://github.com/paychex/Splunk.Conf19 r. Ismo ... View more

Glad to know the issue is resolved, please accept the solution - so it's marked as Resolved. ... View more

Hello @avoelk, Alert throttling should help here? Doc - https://docs.splunk.com/Documentation/Splunk/9.3.2/Alert/ThrottleAlerts. If not alert throttling, you can also dump the results in a lookup / summary index and exclude the events in the consuquitive runs. Please let me know if any questions.   Please hit Karma, if this helps! ... View more

@bowesmana Thank you soooo much, it worked like a charm 🙂 I will sure try it out. (linked list option) ... View more

Along with what @SanjayReddy shared, https://www.splunk.com/en_us/training/certification.html would also help to look over different certifications (individual links have respective prerequisites. ... View more

Thank you very much for your answer ! ... View more

I create notable manually and i update next actions at the same time when i create notable ... View more

Wait a moment. What exactly are you trying to do? Because it sounds as if you were trying to use WebUI to configure... inputs(?) in an app which you installed using WebUI somewhere over a SH cluster. Or are you doing something else? ... View more

Two things. 1) If these values are specific to particular sources, I'd add them at the source as _meta entries to an input stanza on the initial forwarder. 2) These will be indexed fields and need to be added to fields.conf. You have to remember to set INDEXED_VALUE=false for them. Otherwise Splunk will not be able to find them unless you explicitly use the fleld::value syntax. ... View more

Along with what @richgalloway suggested (Splunk Security Essentials / SSE), I would also go for Splunk ES Content Update (ESCU, https://splunkbase.splunk.com/app/3449) The analytic stories and their searches are also available at - https://github.com/splunk/security_content   Please hit Karma, if this helps! ... View more

Hello @grep, Can you please try removing whitelisting from the "CIM Setup" page and only have condition available from Macro page? Let me know if it doesn't work and I can troubleshoot. ... View more

Yeah, you have a same issue as me, Our Deployment start lagging for any function that need to call API for UFs phonehome information. Call Support and they confirm as a "bug" and will be fix at 9.4. I updated to 9.3.1 recently, no more "wrong apps" by still very lagging. I need to run commnd reload deploy-server each time want to deploy some TA to our agent. ... View more

You can use "rule_description" as the field for the above description. ... View more

I lost track of this thread, but the issue here was resolved some time ago. More advanced in our deployment and now looking at other issues lol.  ... View more

Or | stats list(SourceType) as "Source-Type", list(GB) as GB by Index | appendpipe [| stats sum(GB) as GB | eval Index="Overall Total"] ... View more

This is a little late, but I was interested in doing the same thing as OP. Looking at ES dashabord source it looks like key indicators visualization is custom. Make me question using it in my own dashboard. Is that a good idea?   ... View more

There is some confusion. We do not talk about  "Splunk Add-on for Cisco ESA".  I have asked for MIME Decoder Add-on for Cisco ESA  Compatibility This is compatibility for the latest version Splunk Enterprise Platform Version: 9.2, 9.1, 9.0, 8.2, 8.1, 8.0 ... View more

This one have always help with all Azure onboarding questions, want to give it a try? - https://jasonconger.com/splunk-azure-gdi/ Reference -  https://www.splunk.com/en_us/blog/tips-and-tricks/getting-microsoft-azure-data-into-splunk.html?locale=en_us     ... View more

Hello @yuvaraj_m91  Can you please elaborate the question a bit? ... View more

Hello @heskez Yes it's possible. You can have a custom lookup popped-up and integrate the same local intel - https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Addlocalthreatintel   Please hit Karma, if this helps! ... View more

I just stumbled upon this post while looking for something semi-unrelated. FWIW: There are some instances where it must be set to "true" in the .conf files. I had an issue back in Feb where queries were not displaying length of execution in Splunk 9.0.8.  Found a KB article in Splunk support that suggested it might be caused by a setting** in limits.conf that was set to "1" instead of "true". We changed it to "true" and that fixed it. We did a little digging with the rest API and found that it would return 1/0 for the configs, but when looking at the .confs, they were written as true/false. **I won't reference the setting so as to not upset the Splunk Gods who may hold support contracts sacred. ... View more

Sorry for the late response on this but this is exactly what we did created a user and role separate from the others exec_view and assigned that role read-only permissions and assigned it to specific users. Thanks for the information!  ... View more

Hello @splunky_diamond, As stated by 2 folks, resource consumption depends on multiple factors. If you are planning to enable ~15 use cases in ES for learning purpose with all-in-one test environment, 32 GB RAM, 32 vCPU, and 200 GB hard disk should be enough. Base configuration for ES is as below -  https://docs.splunk.com/Documentation/ES/7.3.1/Install/DeploymentPlanning ... View more

Better to raise Splunk Support case for better troubleshooting 🙂 ... View more

Hello @dc18, have you checked https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatch and searched for EC2 on the page? ... View more