Splunk Enterprise Security

Why are TA-DNSServer-NT6 fields, lookups, and aliases not showing in the Splunk App for Enterprise Security?

jsmith39
Path Finder

Most, but not all of the field extractions, lookups, and aliases created in the TA-DNSServer-NT6 app are viewable when looking through the Search and Reporting application, but not when searching through the Enterprise Security application.

The TA-DNSServer-NT6 sharing is set to Global (everyone-read,admin-write)

Unsure why only a handful of Lookups generated fields are viewable through ES, but everything is viewable through Search&Reporting.

0 Karma

jsmith39
Path Finder

I'm guessing this is some kind of bug with how Enterprise Security ingests applications, if I copy the props and transforms from TA-DNSServer-NT6/local and place them in SplunkEnterpriseSecuritySuite/local then I get all the field extractions, etc that I'm expecting.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...