×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
CyberESIArch
Engager
Member since: ‎12-13-2024
‎12-16-2024
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎12-13-2024
Activity Feed
View All

Re: Multiple Indexes - SentinelOne

by in Splunk Enterprise
‎12-16-2024 01:40 PM
‎12-16-2024 01:40 PM
I appreciate the response. Updating the macro doesn't seem to make any real difference. I am going to reach out to SentinelOne and see what they have to say, if anything.  ... View more

Re: Multiple Indexes - SentinelOne

by in Splunk Enterprise
‎12-15-2024 07:07 PM
‎12-15-2024 07:07 PM
Thanks. I'll take a look. I think I tried modifying that search macro once already. I'll try it again.  ... View more

Multiple Indexes - SentinelOne

by in Splunk Enterprise
‎12-13-2024 01:11 PM
‎12-13-2024 01:11 PM
We have more than one instance of S1 configured in the SentinelOne app on our SH. We do NOT have the S1 TA installed anywhere else. We have noticed that you can only specific a single "SentinelOne Search Index" in the base configuration. We have more than one index because we have configured each instance we have to go to different indexes. Because of this, the only index where events are typed and tagged properly is the index we have selected in the app.  Anyone know how we can get around this and have the events in the other indexes typed and tagged correctly? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎12-16-2024 05:08 PM
Karma given to
View All