About dherrald_splunk

dherrald_splunk · ‎09-15-2019

Please just email bots@splunk.com Thanks

dherrald_splunk · ‎05-25-2019

I downvoted this post because wrong and unnecessarily complex to boot.

dherrald_splunk · ‎05-25-2019

I downvoted this post because wring and unnecessarily complex to boot.

dherrald_splunk · ‎04-28-2019

Just email bots@splunk.com and we will send you the v1 and v2 question sets.

dherrald_splunk · ‎11-05-2018

Depending on the versions of the CIM and Windows TA, this base search might work for you: | from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"

Posts	5
Solutions	1
Karma Given	3
Karma Received	4
Member Since	‎04-14-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Re: BOTS: Where is the questions listing?

Re: Import Splunk Enterprise Security and ESCU use...

Re: Import Splunk Enterprise Security and ESCU use...

Re: Getting started with BOTS 2.0 - need help

Re: How do you edit a correlation rule in a datamo...