AS a partner. under Splunk Show you havre a tab with workshops and enablement materials. If the SOAR workshop does not show, contact your Splunk Partner Technical Manager or your distributor. ... View more

Hi you can always ask that splunk split your enterprise license to 5 and 45GB license file. Then ask also 5GB ES license. Then just use separate LM where to put those two 5+5 files and use that for your SIEM instance. This will fulfill official requirements. r. Ismo ... View more

I am very new to Splunk but I just encountered the explanation for this in a course 🙂 When no Dataset is specified in the From clause, Splunk assumes the first root Dataset is addressed. When you want to address any root Dataset other than the first one, you must specify it explicitly. Therefore, it is best practice to ignore the fact that Splunk assumes the first root Dataset and specify it in every use even if Splunk allows you to save that little bit of typing 😉     | tstats summariesonly=t count FROM datamodel=model_name.dataset_1 where nodename=dataset_1 by dataset_1.FieldName       ... View more