About Sultan77

Sultan77 · ‎04-08-2025

Dear @gcusello Can you explain how to group more than one finding in one investigation?

Sultan77 · ‎04-08-2025

Good day for everyone, I've built multiple use-cases through correlation search. The concern here , I am getting multiple alerts for same case. how can I set it to give only one alert contain all data. screenshot can explain more:

Sultan77 · ‎03-27-2025

Dear @livehybrid You're right, that's exactly what I'm attempting to do. As for limiting the events returned, I'm working on specifying something distinctive, like the host that triggered the Event ID or the user involved.

Sultan77 · ‎03-26-2025

Dear @ITWhisperer , I am trying to set a correlation search. ( content management -> correlation search)

Sultan77 · ‎03-26-2025

Hello everyone, I’ve encountered a problem while setting up a correlation search. For instance, when I use the following query: index=windows AND EventCode=4624 I end up getting multiple alerts. To refine this, I attempted to add a Drill Down Search like this: index=windows AND EventCode=4624 host="$host$" However, this returns no results. Does anyone have suggestions or ideas that might help resolve this? Any input would be greatly appreciated!

Sultan77 · ‎02-17-2025

looks nice, but how to do the correlation with it?

Sultan77 · ‎02-17-2025

Good day everyone. I am trying to monitor the environment hosts whether if any stopped sending logs. The challenge here to make through content management > correlation search. So it can be scheduled every ex: 2 hours. any idea?

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-17-2025

Online Status	Offline
Date Last Visited	‎04-07-2025 10:39 PM

Splunk ES - Notable Events

Tokens - Drill Down Search

Silent Log Source

Re: Splunk ES - Notable Events

Splunk ES - Notable Events

Re: Tokens - Drill Down Search

Re: Tokens - Drill Down Search

Tokens - Drill Down Search

Re: Silent Log Source

Silent Log Source

Are you a member of the Splunk Community?