Yes, this is right. There's no copy/pasting. We may need to update some parameters to support larger upload, but apart from that we can simply upload the ES package from the UI, perform the setup and deploy the Bundle. ... View more

Hello @dataisbeautiful, You can just add the other field name afte the by clause? can you give the current search which you are using and confirm if the ID field that you want to add is in the events itself? ... View more

A couple of things -  Can you confirm there's no event suppression rule? Can you confirm the time range are exactly the same and not being rounded off (for example if it's 24 hours, it's same in both and not rounded off) Can you confirm the result count difference between index=notable VS `notable` (notable macro) and what's the count difference? ... View more

On top of what @kiran_panchavat mentioned, once we generate the Short IDs, we can also add in Incident Review Dashboard as a custom field - https://www.splunk.com/en_us/blog/security/modifying-the-incident-review-page.html#:~:text=To%20configure%20Incident%20Review%20and,see%20Incident%20Review%20%E2%80%93%20Event%20Attributes. ... View more

Hello @KKuser Have you tried adding the events in the Investigation? - https://docs.splunk.com/Documentation/ES/8.0.2/User/StartInvestigation You can add multiple notable events in Investigation and write down notes as well. Also, if you want to create Notable events from any raw event, you can simply click on Edit Event and Create Notable event right from the search. Please let me know if you have any questions on the same. ... View more

Did you go through the above response and have follow-up questions? ... View more

@AShwin1119 Did you went through the response and have any further questions? ... View more

The question seems not to provide all the information (or at least I am unable to understand). Would you please elaborate more? ... View more

Hello @AShwin1119 Would you be able to confirm why we need to have props / transforms configuration? As far as I understand, we can just have default _TCP_ROUTING configured to send all SH events to Indexers through outputs configurations - isn't it? Ref Doc - https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Forwardsearchheaddata ... View more

So if I understand this correctly in simple terms - you want to get notified whenever there's a notable event with certain urgency? If so, do you want to get notified via Email? We can use Notable macro (`notable`) in order to get the notable details along with urgency and use fields like source and urgency - in order to get the specific result. ... View more

Yes, search for "_intel" in Lookup Definition and you will see all Threat Intel Lookup along with definition -  All lookups from the specific categories gets combined / merged and used to Threat Matching. For example, everything related to IP will fall under ip_intel lookup.  Please hit Karma, if this helps! ... View more

Glad to know the issue is resolved, please accept the solution - so it's marked as Resolved. ... View more

Hello @avoelk, Alert throttling should help here? Doc - https://docs.splunk.com/Documentation/Splunk/9.3.2/Alert/ThrottleAlerts. If not alert throttling, you can also dump the results in a lookup / summary index and exclude the events in the consuquitive runs. Please let me know if any questions.   Please hit Karma, if this helps! ... View more

Hello @shivprasad Can you please have a check on below list -  1. Validate Splunk Service is Running - ./splunk status 2. Confirm for which range of IP addresses, port 8000 is Open 3. Validate If you’re using a VPC, ensure there’s an Internet Gateway attached and the route table includes a route for 0.0.0.0/0 pointing to the Internet Gateway 4. Try restarting Splunk service once - ./splunk restart   Also, Can you please confirm if there are any ERROR / WARN messages under - "/opt/splunk/var/log/splunk/splunkd.log" (Use tail command to validate) ... View more

Can you check if below works -    <form version="1.1" theme="light"> <label>Time Picker Input</label> <description>Replicate time picker issue</description> <fieldset submitButton="false"> <input type="dropdown" token="item" searchWhenChanged="true"> <label>Select Item</label> <choice value="table1">TABLE-1</choice> <choice value="table2">TABLE-2</choice> <choice value="table3">TABLE-3</choice> <change> <condition value="table1"> <set token="tab1">"Table1"</set> <unset token="tab2"></unset> <unset token="tab3"></unset> </condition> <condition value="table2"> <set token="tab2">"Table2"</set> <unset token="tab1"></unset> <unset token="tab3"></unset> </condition> <condition value="table3"> <set token="tab3">"Table3"</set> <unset token="tab1"></unset> <unset token="tab2"></unset> </condition> <condition> <unset token="tab1"></unset> <unset token="tab2"></unset> <unset token="tab3"></unset> </condition> </change> </input> <input type="time" token="time" searchWhenChanged="true"> <label>Select Time</label> <change> <set token="is_time_selected">true</set> </change> </input> </fieldset> <row depends="$tab1$ $is_time_selected$"> <panel> <table> <title>Table1</title> <search> <query> | makeresults | eval Table = "Table1" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row depends="$tab2$ $is_time_selected$"> <panel> <table> <title>Table2</title> <search> <query> | makeresults | eval Table = "Table2" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row depends="$tab3$ $is_time_selected$"> <panel> <table> <title>Table3</title> <search> <query> | makeresults | eval Table = "Table3" | eval e_time = "$time.earliest$", l_time = "$time.latest$" | table Table e_time l_time </query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   Please hit Karma, if this helps!   ... View more

Hello @Kenny_splunk we would need to call individual rest endpoints and append results. Like, /data/props, /data/transforms. Did a quick ChatGPT and found below search -  | rest /servicesNS/-/<app_name>/data/props | append [| rest /servicesNS/-/<app_name>/data/transforms] | append [| rest /servicesNS/-/<app_name>/data/macros] | append [| rest /servicesNS/-/<app_name>/saved/searches] | append [| rest /servicesNS/-/<app_name>/data/ui/views] | append [| rest /servicesNS/-/<app_name>/data/ui/nav] | append [| rest /servicesNS/-/<app_name>/data/ui/manager] | append [| rest /servicesNS/-/<app_name>/data/ui/panels] | append [| rest /servicesNS/-/<app_name>/data/collections/config] | fields title, eai:acl.owner, eai:acl.app, eai:acl.sharing | search eai:acl.app="<app_name>" | table title, eai:acl.owner, eai:acl.sharing | sort eai:acl.owner, title    Replace <app_name> with specific app name (like search).   Please hit Karma, if this helps! ... View more

Along with what @SanjayReddy shared, https://www.splunk.com/en_us/training/certification.html would also help to look over different certifications (individual links have respective prerequisites. ... View more

Hello @uagraw01, I believe below should work -  props.conf -  [<sourcetype>] TRANSFORMS-add_fields = add_additional_field transforms.conf -  [add_additional_field] REGEX = .* FORMAT = ServerName::mobiwick ServerIP::10.30.xx.56.78 WRITE_META = true   The above will add additional 2 fields in the events.  Note that, it will not update the _raw events. Please accept the solution and hit Karma, if this helps! ... View more

Along with what @richgalloway suggested (Splunk Security Essentials / SSE), I would also go for Splunk ES Content Update (ESCU, https://splunkbase.splunk.com/app/3449) The analytic stories and their searches are also available at - https://github.com/splunk/security_content   Please hit Karma, if this helps! ... View more

Hello @Raphy AFAIK, there's no default method which mandates having owner assigned while closing the notable event. That being said, you can do either of following -  1. Have a default owner assigned - https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-it-possible-to-auto-assign-notables-in-Enterprise-Security 2. Schedule a search which periodically give you list of notable where owner is not assigned -  | inputlookup incident_review_lookup | where status="Closed" AND isnull(owner)   Please accept the solution and hit Karma, if this helps! ... View more

More often than not it would be because of the default macro not being updated - which has information about "in which index the data resides". As @Bhumi suggested, can you share the name of the TA to assist you more? ... View more

Hello @zksvc Was the notable created after you updated the next actions - or was it already generated and later you updated the Correlation Search? ... View more

Hello @grep, Can you please try removing whitelisting from the "CIM Setup" page and only have condition available from Macro page? Let me know if it doesn't work and I can troubleshoot. ... View more

You can use addtotals as below -  | addtotals col=t row=f labelfield=index label="Overall Total"   Please accept the solution and hit Karma, if this helps! ... View more