We were testing two externally hosted threat feeds. After adding them to the Splunk App for Enterprise Security using the ES documentation ,the feeds began giving us a tremendous amount of false positives. We removed the feeds from Settings > Data Inputs > Threat Intelligence Downloads, ensured all CSV files were not in any DA-ESS-Threat* subfolder and all SA-Threat* subfolder. Restarted the server. We are still getting threat activity matching to these sources. Are there any other steps we need to take to make sure our data is no longer matched against this bad data feed? Is it stored in a summary index or other index that we should clean? Any help would be greatly appreciated! ... View more

I have been testing the Splunk Add-on for Nessus and want to start using the feature with fresh data. Is there a way to clear out all previously imported scans so we can start from scratch? ... View more

I currently have 4 indexers setup as VMs. Each indexer has dedicated LUNs for their data. I'm trying to find a way to preserve data while condensing the 4 virtual indexers into a single dedicated hardware host. Any fairly straight forward method to do so or is it a situation where I am better off keeping them for historical purposes for a year (PCI data) and have all of my forwarders just start writing to the new indexer? ... View more