Hi Everyone, In my Splunk environment, I have about 15 users, but the one responsible for creating correlation searches is on 1 account, let's say account 7. Then I plan to delete the account, before I delete it I create another account with id 13 and move all correlation search/ saved search/ dashboard created by account 7 to account 13 so that the owner will move everything to account 13 and account 7 can be deleted immediately. Currently, my problem is that when I move to account 13, account 13 will get a notification "Waiting for queued job to start Manage Jobs" which causes me to not be able to search. Even though account 13 for the role has been equated with account 7, and the role has also been raised for the role search job limit and user search job limit, but strangely it is still queued. What's even more strange, this 13 account only searches around below 5000 data/day even though other users have more than 5000 data but there are no problems with searching. Here I attach a picture, in this case account 13 is in 4th place or from the brown chart, account 7 is in 5th place, while the account for analysts is in 1,2,3 ... View more

Hi Everyone, in default correlation search the name "Excessive Failed Logins" my drilldown cannot define $info_min_time$ and $info_max_time$ and it make when click drilldown searching in All-Time. If in every correlation search drilldown is matching the time when it trigger in correlation search, why this one searching in All-Time mode?         ... View more

Hi Everyone,  i got error when open Splunk Security Essentials, it says    A custom JavaScript error caused an issue loading your dashboard. See the developer console for more details.   When i check it in my browser console it says   GET http://my.ipaddress:8000/en-US/splunkd/__raw/servicesNS/zake/system/storage/collections/data/RecentlyViewedKO?limit=1&query=%7B%22%24and%22%3A%5B%7B%22type%22%3A1%7D%2C%7B%22id%22%3A%22home%22%7D%2C%7B%22app%22%3A%22Splunk_Security_Essentials%22%7D%5D%7D 503 (Service Unavailable)   since i know 503 code is error from server can i know any website to check where that server down ? i mean i check in Statusgator all is okay.  Any solution ? ... View more

I am encountering an issue regarding the synchronization of update logs between Sophos and Splunk for a specific host, designated as "EXAMPLE01." According to the Sophos console, the device has received updates on the following dates: 19 Nov 2024 20 Nov 2024 26 Nov 2024 2 Dec 2024 3 Dec 2024 10 Dec 2024 17 Dec 2024 21 Jan 2025 However, when I search in Splunk within the same timeframe (1 Nov 2024 to 23 Jan 2025), the logs only show updates on: 3 Dec 2024 10 Dec 2024 17 Dec 2024 I aim to establish a rule that triggers a notification if there has been no update for 20 days or more. Regrettably, despite the Sophos console indicating recent updates, the discrepancies in Splunk raise concerns about accurate monitoring. I have verified the settings under Indexing > Indexes and Volumes in Splunk, and everything appears to be configured correctly. Could anyone provide insights on how to track and resolve this discrepancy? Thank you for your assistance. ... View more

Hi everyone, want to ask why i cannot download data from dashboard. if i make it 4 hours it can, and if i want download in another date ex (1 Jan 2025) its fine, it is only happen when i want download data in (4 Jan 2025).  Since i cannot access any website / media to screenshot from client so i only can photo.  Thank you ... View more

Hey Everyone,  i got information if Wazuh can send data to Splunk, i want reverse it.  Because i want to send data from Splunk to Wazuh, in my case because i have TI who have API that can be send data to Splunk, then i want forward it to Wazuh.  Maybe if using third party like Logstash / Elastic / etc ?  Did anyone know about it? because i never read about it before..  Thanks     ... View more