Hi @karthi2809, you could put the list of links and names in a lookup (called e.g. links.csv) and containing at least two columns (Name, Link). Then you could run something ike this: <row> <panel> <table> <title>Use Cases</title> <search> <query> | inputlookup links.csv | sort Name Link | table Name Link </query> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <condition match="isnotnull($row.Link$)"> <link target="_blank">/app/your_app/$row.Link$</link> </condition> <condition match="isnull($row.Link$)"/> </drilldown> </table> </panel> </row> In this way with a click you run your dashboard. If the dashboards are in different apps then the present one, you have to add the full path.  Ciao. Giuseppe ... View more

Hi @ViniciusMariano , if the structure of the right dataset name is always the same, e.g. : left_dataset_name + _ + other, you could extract the common part using a regex: <your_search> | rex field=right_dataset_name "^(?<left_dataset_name>[^_]+)" | stats values(right_dataset_name) AS right_dataset_name count BY right_dataset_name | table left_dataset_name right_dataset_name I would suppose that you used the join concept and not the use of the join command, that should be avoided because it's very slow and expensive for the system resources. Ciao. Giuseppe ... View more

Hi @splunky_diamond, dest and dvc aren't in the Correlation Search, so it's correct. Instead, address, shouldbe displayed. Ciao. Giuseppe ... View more

Hi @splunky_diamond, probably this isn't the issue, but why do you use quotes? index=fudo_index completed_action="deleted session." | stats values(node_address) AS address values(user) AS user values(fudo_session) AS session values(completed_action) AS "completed action" count(completed_action) AS counter | where counter>0 quots are mandatory when you have spaces or special chars in the field names. Then, why don't you use an aggregation key (the BY clause)? I'd try with something like this: index=fudo_index completed_action="deleted session." | stats values(user) AS user values(fudo_session) AS session values(completed_action) AS "completed action" count(completed_action) AS counter BY node_address | where counter>0 | rename node_address AS address Ciao. Giuseppe ... View more

Hi @jacknguyen , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @LearningGuy , you can save your static data: in a csv lookup, in a kv-store lookup, in an Index, if you need time updates on your data. The more frequent approach is to use a csv lookup. Ciao. Giuseppe ... View more

Hi @splunky_diamond , I suppose that You are confusing passing some Correlation Search fields in the title of the CS itself (using a token) with the fields to display in an Incident review. The example you gave is of the first type, but, if I correctly understand, you want to display other fields in the Notable information. to do this you must add these fields to the Correlation Search results (e.g. as values in the stats command), so that they are written in the Notable event and then, go to [Configure > Incident Review>Incident Settings] and add these fields to those displayed (if they were not already present). Ciao. Giuseppe ... View more

Hi @splunky_diamond , it's always a pleasure! Ciao. Giuseppe ... View more

Hi @Jyo_Reel , I don't know what could happen, maybe someone did an error and configured data input on 8089. The only way to understand something is finding who sent this unencrypted traffic on this port and check its configurations. Ciao. Giuseppe P.S.: Karma Points are appreciated by all the Contributors 😉 ... View more

Hi @BB_MW  in the interesting fields you have fields contained at least in 20% of the events, if you add action=* to you search do you see the field? Then, did youchecked if the sourcetype that you associated to the field extraction is in the vents that you're searching? the new field extraction is related only tho the declared sourcetype. Ciao. Giuseppe ... View more

Hi @tommasoscarpa1, if you remove the XML tags, how can you recognize fields? maybe you could use INDEXED_EXTRACTIONS = XML in your sourcetype definition having all the field extracted. Ciao. Giuseppe ... View more

Hi @dungnq, is it mandatory for your ingestion? this is the reason for the double ingestion: logs arrive from different files. Without crcSalt = <SOURCE>, Splunk doesn't index twice a log. Ciao. Giuseppe ... View more

Hi @jacknguyen , in this case (Frozen buckets), you can use the above filesystem for Frozen  buckets., but not for hot, warm or cold buckets. Ciao. Giuseppe ... View more

Hi @dungnq, are you using crcSalt = <SOURCE> in your inputs.conf? Ciao. Giuseppe ... View more

Hi @jacknguyen, what do you mean with backup log? in an indexer you have hot/warm and cold buckets, that you have to store in a filesystem (not NFS and not shared) and each one different. If you want to have a copy of your data, you can do it, what what's the meaning of? You can have a backup, but usually only warm and cold buckets are under backup policy because to backup hot buckets (that continously change) you need to stop Splunk. Ciao. Giuseppe ... View more

Hi @emily12234 , open a case to Splunk Support, or, otherwise, submit a new add-on, indicating in the information that it replaces the old archived add-on. Ciao. Giuseppe ... View more

Hi @splunky_diamond , there's one general answer to all your questions: it depends on your internal procedures (or playbooks), in other words, it depends on how you work. Answering to your questions: 1) the take in charge action is usually the first action, so I always saw that investigations were started after a SOC analyst took in charge one or more Notables (often more Notables are take in charge and associated to an investigatin in block). 2)  usually I saw that SOC Anaysts change the status on their Notables by themselves. 3) as I said it depends on your internal procedures, anyway, the closing is tracked. Ciao. Giuseppe ... View more

Hi @LearningGuy , yes both the solutions are internal lookups. They are almonst uqual fast: if you have few rows, hundreds until few thousands, you can use csv, if you have more rows, KV-Store is better. In addition KV-store is prefereable is you need a key in your csv, eg for thacking. Ciao. Giuseppe ... View more

Hi @dm1 , I'd follow the first solution in three steps: install a new Splunk on AWS, possible the sam version that you have on-premise, not a new version, configure the new Splunk as SH connected to your Indexers, copy the above folders in the AWS Splunk, eventually update your Splunk and apps version. because you don't need to copy the bins or the libraries that are always the same, you need only to copy the confs that you did in your on-premise installation. Ciao. Giuseppe ... View more

Hi @whitecat001, sorry, it isn't so clear: do you want the amount of data of each search or to know which indexes are used in each search or what else? Ciao. Giuseppe ... View more