Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About saikiran334
saikiran334
Explorer
Member since:
02-04-2019
01-20-2024
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 02-04-2019 |
Activity Feed
- Posted List of newly created indexes (year to date) on Splunk Dev. 12-02-2020 09:51 AM
- Karma Re: Sync between Onprem SH and Azure search head for isoutamo. 11-09-2020 11:13 AM
- Posted Re: Sync between Onprem SH and Azure search head on Splunk Enterprise. 11-09-2020 08:47 AM
- Posted Sync between Onprem SH and Azure search head on Splunk Enterprise. 10-22-2020 07:37 AM
- Karma Re: Why is the Whitelist file "missing" in Threathunting app? for nickhills. 06-05-2020 12:51 AM
- Karma Integration between Azure Data Lake and Splunk for btanjialih. 06-05-2020 12:50 AM
- Posted CIM complaince indexes list on Knowledge Management. 05-04-2020 10:42 AM
- Tagged CIM complaince indexes list on Knowledge Management. 05-04-2020 10:42 AM
- Tagged CIM complaince indexes list on Knowledge Management. 05-04-2020 10:42 AM
- Posted Re: Can I collect application logs from Azure to Splunk? on Getting Data In. 04-20-2020 09:10 AM
- Posted Splunk indexed data into Azure datalake storage or Blob storage on Getting Data In. 04-16-2020 07:52 AM
- Tagged Splunk indexed data into Azure datalake storage or Blob storage on Getting Data In. 04-16-2020 07:52 AM
- Tagged Splunk indexed data into Azure datalake storage or Blob storage on Getting Data In. 04-16-2020 07:52 AM
- Posted How whitelist editor is working in threathinting app ? on Splunk Enterprise Security. 04-09-2020 11:41 AM
- Tagged How whitelist editor is working in threathinting app ? on Splunk Enterprise Security. 04-09-2020 11:41 AM
- Tagged How whitelist editor is working in threathinting app ? on Splunk Enterprise Security. 04-09-2020 11:41 AM
- Posted Re: How does the threathunting index get populated? on All Apps and Add-ons. 03-27-2020 08:51 AM
- Posted Re: How does the threathunting index get populated? on All Apps and Add-ons. 03-27-2020 07:37 AM
- Posted Re: How does the threathunting index get populated? on All Apps and Add-ons. 03-19-2020 07:45 AM
- Posted Re: Why is the Whitelist file "missing" in Threathunting app? on Splunk Dev. 01-27-2020 12:56 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-02-2020
09:51 AM
Hello , I'm trying to identify the total list of indexes have been created in the Splunk (all this year ) , i have used below query to find out , but looks like this is not correct index = _audit operation=create
| stats values(object) as new_index_created by _time splunk_server
| rename _time as creation_time splunk_server as indexer|convert ctime(creation_time)|dedup new_index_created any inputs ?
... View more
11-09-2020
08:47 AM
thanks, @guilmxm @isoutamo for your views on it I'm thinking to connect Azure SH(stand-alone) with the Onprem indexer cluster (by taking network configs, firewalls, etc into account)
... View more
10-22-2020
07:37 AM
Hello , 1) Currently we do have a search head in OnPrem where indexer clusters have been connected to ! 2) Now, we would like to spin up new Splunk SH instance(on Ubuntu) in AZURE and install "TrackMe" app on this new Azure SH by syncing with OnPrem SH Is this a use case anyone already tried or is it possible to apply ? Reason: We'd like to have our own SH in Azure exclusively for our own team and utilize it
... View more
Labels
05-04-2020
10:42 AM
I am wondering is there any method to list out CIM compliance indexes on demand through SPL query ?
... View more
- Tags:
- cim
- splunk-enterprise
Labels
- Labels:
-
other
04-20-2020
09:10 AM
@Koko12345678, out of curiosity ,
Any how you have application logs in Azure for long term storage , and may i know why again you want to index this data from AZure to Splunk ?( any specific requirement )
... View more
04-16-2020
07:52 AM
Is there any way to send already indexed splunk data (from one index) into Azure data lake storage or Azure Blob storage?
Splunk data >> Azure Datalake storage/Blob storage
... View more
04-09-2020
11:41 AM
I am wondering how whitelist lookups concept is working in threathinting app?
is it something we need to push the data in everytime manually or is there any automatic way to popup the required fields ?
... View more
03-27-2020
08:51 AM
@afx, can you try after clearing up cache and cookies
... View more
03-27-2020
07:37 AM
@olafhartong , thanks for your explanation , i'd like to know "how saved searches feeds threat hunting summary index and What mechanism captures their results and adds them to the summary index?
... View more
03-19-2020
07:45 AM
@afx , have you configured "threahunting" index on indexers if yes,
can you please put those stanzas here ?
... View more
01-27-2020
12:56 PM
cool , thanks @nickhillscpl for your quick reply towards this question, i really appreciate.
... View more
01-27-2020
12:49 PM
or we can modify the query a bit to ignore this specific lookup name ?
... View more
01-27-2020
12:46 PM
so here , i don't need to create one more new lookup and attach under "therathunting app" ? am i correct ?
... View more
01-27-2020
12:42 PM
Yes, we have one similar look up under "ES-content update app"
... View more
01-27-2020
12:09 PM
nope, i did not
i checked in lookups and lookup definitions both
... View more
01-27-2020
12:06 PM
thanks @nickhillscpl , we lately migrated our splunk platform from one QA server to other ,
1) when i copied same query and search in old instance , result showing as "all lookups installed " ,
2) but same thing on new instance showing one lookup missing (with same "rest" query though)
... View more
01-27-2020
11:25 AM
I have installed threat hunting app and configured "threathunting" index as well , when i navigated to "About this app" tab , i found one of the whitelist file missing out of 13, when i checked below link for lookups , i did not find "missing" lookup file
below link i used for lookups:
https://github.com/olafhartong/ThreatHunting/commits/master/files/ThreatHunting.tar.gz
i am wondering the above link got last update about 8 months ago , since then no update ,
where i can get missing empty lookup ?
splunk version: 7.2.6
App version: 1.4.1
... View more
- Tags:
- splunk-enterprise
01-27-2020
06:44 AM
thanks @phantom_mhike , we opened case with Phantom and provided debug logs , as of now they found some issue in playbook app configuration , current status is in progress
... View more
01-22-2020
06:58 AM
1) We have installed Phantom on Linux server and while executing playbooks in automation mode ,Our platform is getting hanged occasionally and stops all playbooks execution , so that we could not able to execute playbooks continuously. 2) so eventually each playbook keeps on spinning for hours and hours , at that time we are restarting "DECIDED" from System health tab , at that moment everything goes normal.
we are not sure which specific process/activity causing this behavior?
... View more
- Tags:
- phantom
Labels
- Labels:
-
configuration
-
installation
-
troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-20-2024
12:53 PM
|
