Tokens in notable event titles and descriptions not getting expanded to include the values of the tokens on the Incident Review dashboard, though the search Time extractions does exists in the notable event Example:- My Notable Event Title Contains the following text Suspicious activity detected from User $UserId$ Expected Output for Title in Incident Review Dashboard Suspicious activity detected from User XYZ How the Title Column gets displayed in Incident Review dashboard Suspicious activity detected from User $UserId$ However, the extractions does work for built-in extractions or fields like sourcetype etc.  Tokens work with few extractions, and not with few even though both of the search time extractions does exists in the notable events ... View more

We have scenario where we run a indexer cluster with 10+ indexers and the Universal Forwarders send data to all these indexers. Since, all these indexers do have different Common Names (CN), they do have different SSL certificates and we are left with an option to use server-specific [SSLConfig] stanza for each indexer in the outputs.conf of each forwarder. This solution has challenges when we are managing larger indexer clusters, where we keep adding / removing indexers from Indexer Cluster Hence, would like to pursue on the alternate options available for the same. Does Splunk support SSL certificate Subject Alternative Name (SAN). - SSL certificate that has the ability to cover multiple host names (domains)? Any alternate options available are also much appreciated... ... View more

We are planning to upgrade our multi-site cluster from Splunk Core ES 7.3.4 to 8.0.5 in a phase-wise manner. Splunk Documentation indicates " Indexers that run versions of Splunk Enterprise lower than 8.0 cannot handle bucket replications from versions that run 8.0 and higher" and hence to put the cluster in maintenance mode while Indexer cluster upgrade is in Progress. Now, since it's a multi-site cluster can I upgrade my indexer cluster in site-1 today and site-2 tomorrow? And in such case do I need to extend the maintenance mode on cluster for two days? Or else can I have my indexer cluster with multiple versions of Indexers till the upgrade finishes... ... View more

Hi Team, How do I identify the management node or master node in an existing distributed UBA Deployment (7 node or 10 node or 20 node) https://docs.splunk.com/Documentation/UBA/5.0.3/Install/TSUBAServicesNodes doesn't have details about the same. ... View more

Hi Team, The following inputs.conf works on localhost to monitor a registry key, but not working on the universal forwarder. [WinRegMon://HKLM] baseline=1 disabled=0 hive=\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.* index=windows proc=.* type=set|create|delete|rename BTW even the following hive attribute too works fine on local host but not on universal forwarder hive=HKEY_LOCAL_MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.* But the default configuraiton of inputs.conf works on both local host and the universal forwarder. [WinRegMon://default] disabled = 0 hive = .* proc = .* type = rename|set|delete|create index = windows   Any references are much helpful. ... View more

Hi Team, The following inputs.conf works on localhost to monitor a registry key, but not working on the universal forwarder. [WinRegMon://HKLM] baseline=1 disabled=0 hive=\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.* index=windows proc=.* type=set|create|delete|rename BTW even the following hive attribute too works fine on local host but not on universal forwarder hive=HKEY_LOCAL_MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.* But the default configuraiton of inputs.conf works on both local host and the universal forwarder. [WinRegMon://default] disabled = 0 hive = .* proc = .* type = rename|set|delete|create index = windows   Any references are much helpful. ... View more