@WhitneySink Thanks for the resource links. Is it possible to directly upgrade from 8.1.2 to 9.x version? ... View more

@sruthimadhu Two questions :  Share your Splunk versions - previous and updated. What is the version of duo_splunk app in use and the monitoring stanza content for duo_input://PureConnectCloud Splunk Logs". The error clearly pointing out that there is an issue in executing your monitoring input stanza PureConnectCloud. Refer this from Splunk. Troubleshoot script errors in Splunk Enterprise Security - Splunk Documentation ... View more

@Valen1 - For delayed searches case, I did the below to fix it. - Monitoring Console in your Search head would help us to determine why searches are delayed. Inside monitoring console, go to Search> Scheduler Activity: Instance. Look for Skip ratio under Runtime statistics dashlet.  - Identified searches trying to run at the same time.  Reschedule by tweaking the cron schedules of them and skip ratio is reduced. - Identify searches not completing before the next scheduled run-time, run them in Search app and find the average time taken to complete it. For larger indexes or datamodels especially for network, try to minimize the earliest time range to 1 hour or use summary indexes.  Hope this helps and an upvote is appreciated. Thank you. ... View more

@Jishnukn10 -  Search macros in Splunk are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. It's enclosed within acute/back quotes `macro_name` on your search like  `drop_dm_object_name(field)`. You can see these macros in Splunk and define them under Settings > Advanced Search > Search Macros. All about macros here :  Use search macros in searches - Splunk Documentation Hope this helps.  ... View more

You're welcome. ... View more

Firstly, we need to make sure that the correlation search results include the field and then make sure that Incident Review can display the field. Some fields are consistent for all notable events and each notable event returns different additional fields depending on the syntax of the correlation search.  To be specific on your question, we can't customize the fields for each notables, any changes that you make to notable event fields affect all notable events. The best you can do is remove the unwanted annotations fields and consider displaying important fields like user/srcip,destip,port, filepath etc. To add the field to the list of additional fields for a notable, you can follow the below steps. From the Splunk Enterprise Security menu bar, select Configure > Incident Management > Incident Review Settings. Click Add new entry to add the new field to the Additional Fields section of the notable event details. Type a Label to use as the display name of the field in the notable event details. Type a Field to match the field that you want to appear in the notable event details. Click Done & Save. Hope this helps and trying to assist you with what I know.  For reference :  Customize notable event settings in Splunk Enterprise Security - Splunk Documentation ... View more

This is my search string for ES suppression config. index=network dest_port IN(389,636) src_ip=10.x.x.x  ... View more

Looking forward for securing Splunk. As the new critical vulnerability emerges on Splunk Deployment server (on prem), it's high time to tighten the security in Splunk. ... View more

Your splunk enterprise version should be on atleast 8.1 to upgrade to 7.0 ES app version. Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. Splunk Enterprise version 7.1 is no longer supported as of October 31, 2020. If you have PS support, they will guide you on upgrade steps. We faced few critical issues during upgrade from 7.x to 8.x. please refer the "Known issues" listed by splunk which would help you in for a successful upgrade. Pls don't rush in, plan the upgrade well and do it. Otherwise, it may cause production issues.   https://docs.splunk.com/Documentation/Splunk/8.2.4/ReleaseNotes/KnownIssues Let me know if you need any further help in this regard. Thank you.       ... View more

Found the issue, thanks ... View more

Can I upgrade to ES version 7.x from 6.4.1 directly. Also does this version have compatibility with Splunk Enterprise versions? We are running on 8.1.4. ... View more

Any help? ... View more

Here is your SPL query, let me know if it works for you. index=wineventlog sourcetype="Wineventlog:Security" EventCode=4625 OR EventCode=529 Account_Name!="" | stats count by Account_Name | sort -count | head 10 Event code 529 to capture failure events from Win 2003 or older versions Account_Name!="<put value which doesn't make any sense to you like blank/- etc> head 10 - for top 10 results. Hope this helps and happy Splunking! ... View more