All Apps and Add-ons

get correct "Block Rules"

jaxjohnny2000
Builder

According to the details section of the instruction for this app: "to get correct "Block Rules" statistics you have to create a last ruleset with a rule named "Last Rule" which is active in all cycles (Request, Response, Embedded)."

How is this done?

I reviewed that documentation, but there are no details about that rule set. It simply says create a rule set and make it active with no details about what the rule set is supposed to contain. Is there a way to get clarification on what is expected there?

PavelP
Motivator

Hi

You have to create a ruleset named "Last Ruleset" in the bottom of your ruleset tree, then create a rule named "Last Rule" inside it. That's all!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...