Trying to convince my boss to switch to Splunk but the biggest issue is ESM's ease of use. Everything is pretty much plug n play on ESM where Splunk takes a lot of work to get the same results. Here are a couple of examples: 1. ESM he can go in and easily create a watchlist with all the server IP's and add that to an alert to tell it not to alert if these IP's are in the src or dest. 1. Splunk i have to create a lookup then create a lookup definition then create the macro and if i want to add an IP to the file i have to go into the CLI and add the new IP 2. ESM has an alert page that you can look at all the alerts that have popped and check a box when you have decided that you have done enough investigate on that alert which allows other analyst to know that alert has already been investigated 2. I have not seen anything like this in Splunk without spending more money. 3. ESM really has no easy way to query on the fly so Splunk does win this one 4. He wants a solution that a new analyst can sit down with minimal training and use. I dont like the idea of button pushers but we don't have months or years to train a new analyst. (or the money) If i could resolve issue 1 and 2 so anyone could do that stuff without having to be a programmer and do it all in the GUI i think i could convince him. Licensing cost is not an issue, both are already licensed. Any ideas? ... View more

is there anyway to setup something on a dashboard that will tell me if a service on a remote centos box goes down. I run arkime on a centos8 box and i want a dashboard in splunk that will show me the status of the services arkimecaprute.service arkimeviewer.service elasticsearch.service is this possible? ... View more

is there anyway to create a file with a list of IP's that i can use in the search field? i am trying to search for IP's that are not in this specific list but i don't want to create the list for every search. For instance if i want to look through zeek conn.log for bad_guy IP's from a predefined list of bad guy IP's. Thank you for any help. ... View more

I am not the best with setup so i am looking for an all in one step by step for getting bro logs into splunk. I previously had the logs forwarded but the fields were not showing up. Here is my setup thus far: Bro 2.6.4 on Ubuntu server 18.04 LTS (fresh Install based on https://wpcademy.com/how-to-install-bro-network-security-monitor-on-ubuntu-16-04-lts/ minus the geoIP stuff) Splunk Enterprise 8.0.1 (fresh install based on https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/InstallonLinux) started and created admin configured to start on boot I just see so many bits and pieces of what to do next to get Bro logs into Splunk i find myself doing the trial and error thing. Thank you for any help (i know this can't be that difficult) ... View more