About paulstark2

paulstark2 · ‎08-23-2024

| savedsearch "Incident Review - Main" time_filter="" event_id_filter="" source_filter="" security_domain_filter="" status_filter="status=\"1\"" owner_filter="" urgency_filter="urgency=\"critical\" OR urgency=\"high\" OR urgency=\"medium\" OR urgency=\"low\" OR urgency=\"unknown\"" tag_filter=""

paulstark2 · ‎08-23-2024

similar error here, resolved i had a correlation rule is ES calling saved search, it required the addition of "type_filter"

paulstark2 · ‎05-25-2021

I am wondering if someone can tell me of a way to use API or CLI to create custom content definitions in Splunk Security Essentials . i have reviewed documentation @ https://docs.splunksecurityessentials.com/ and there doesnt seem to be any specific information on it.

paulstark2 · ‎02-09-2021

curl -k -u admin:changeme https://localhost:8089/services/saved/searches \ -d name=firstApiTest \ -d disabled=1 \ -d owner=nobody \ -d description=descritionText \ -d search="index=main" \ -d dispatch.index_earliest=-7d \ -d dispatch.index_latestlatest=now

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-06-2020

Online Status	Offline
Date Last Visited	‎08-23-2024 12:15 PM

SplunkSecurityEssentials automation avenues?

Re: How to find variable in argument map for a sav...

Re: How to find variable in argument map for a sav...

SplunkSecurityEssentials automation avenues?

Re: How do you create saved search using REST API ...