Client is asking about Splunk Cloud backup and recovery procedure for DR. Specifically all the configuration, searched, dashboards, fields, tag so on and so on. I can not find a document outlining Splunk cloud polices for high availability, backup and restore can anyone point to this info?     Client ask -  "Could you please check and let me know how and where following items are backed up and what is the process to recover them for DR purpose? Audit logs Usecases Reports, alerts, lookup tables, KV etc Config data Source type config Parsing API, TI Fields config Data model, macros Apps and app config ES config Threat intel config" ... View more

Hello, We ingest logs from another vendor to Splunk, each event contains a "score" field which is predetermined by the 3rd party ranging from 0 - 100. Is there away to add that field value to the risk object score instead of a static risk score in the Risk analysis Adaptive response?  Have been looking at using the Risk factor editor but cant see a way other than setting the static value in the Adaptive response to 100 then creating 100 risk factor like this if('score'="10",0.1,1) if('score'="11",0.11,1) if('score'="12",0.12,1) so on and so on. Thanks        ... View more