These are so general questions... It all depends on what data you have, what service you purchased (bare Splunk Cloud, ES, ITSI...). It's something that would be best discussed with your local friendly Splunk Partner who will sit with you, go through your needs (and budget constraints) and will suggest what can be done, how it can be done and how much it will cost. ... View more

I followed the steps and created the column 'Short ID', but couldn't search using 'Short ID'. Were you able to do so? If yes, how? what's the term you used? ... View more

The method you are saying works for Splunk Enterprise version 7.2.0 and lower. The short ID filter is not available by default once you upgrade to Splunk Enterprise Security version 7.3.0.  Follow the steps for reference: https://docs.splunk.com/Documentation/ES/7.3.0/Admin/CustomizeIR#Create_a_short_ID_column_to_filter_notables ... View more

I'm able to see the 'Mean time to resolution' field in the dashboard. But apart from that I'm unable to find other data points I'm looking for in the dashboard that you are referring to. ... View more

Hi @KKuser  You probably want to include the "source_event_id" field which is a unique field for each of your notable events. Please let me know how you get on, and please consider adding karma or accepting this post if it has helped.   ... View more

Hi @KKuser  Are you referring to the Thinkst Canary tool? If so there are a couple of Thinkst apps for Splunk that will help you out.  Check out the app [for visualising the data] (https://splunkbase.splunk.com/app/6196) and the Add-On [for bringing the data in] (https://splunkbase.splunk.com/app/6195). The priority order of onboarding will depend a lot on your teams ability to respond, and company policy around priorities on threats. Do you have any internal processes which dictate what type of security event is higher priority than others? Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

1. Are my instances independent of each other? A: Yes - these are independent of each other. 2. Can I have anything setup so that the dashboard is visible in both instances? A: Im not aware of anything you can do out of the box to automate the sync between the two instances, the only thing you could do is write some custom code to use the Splunk REST API to sync dashboards between them. I would recommend having your dashboards in an app in source control (e.g. Gitlab/Github) and then deploy to both instances to give you the same dashboards on both. 3. following on this 'You can also setup federated search between different instances so they can search the same data.', how can I do it? A: This is a good starting point (https://www.splunk.com/en_us/blog/platform/introducing-splunk-federated-search.html) which covers the basics of Fed. Search. This wont allow you to sync dashboards, but should give you access to data on either Splunk Cloud stack. Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped. Regards Will ... View more

Hi @KKuser , at first, don't attach a new question to a so old one (nine years ago!) even if on the same topic because it's difficoult to have an answer, it's always better to create a new question. Anyway, if you need information about a validated Splunk architecture for an on premise or hybrid installation  see at https://docs.splunk.com/Documentation/SVA/current/Architectures/About Anyway, in Splunk Cloud you only see two machines: one Search Head for ES and one Search Head for the other apps. You don't know if there's a Search Head Cluster, probably not also because you see only two machines and SH Cluster need three machines. In addition you can upload apps and this operation isn't possible on SH Clusters. In addition, the Indexer layer ss not visible for you even if you see three Indexers and you cannot see the Cluster Manager.  Surely there are many instance of Splunk Cloud in different AWS machines. For more information see at https://docs.splunk.com/Documentation/SVA/current/Architectures/SCPExperience Ciao. Giuseppe ... View more

Hi @KKuser  This sounds like a great approach, remember that its worth getting as much hands-on experience with Splunk as you can to solidify the learning.  Also consider events like Splunk4Rookies and other virtual workshops (https://discover.splunk.com/EMEA_Virtual_Workshops.html) which is a great opportunity to ask questions to other users too! Here are the blueprints for the exams you are interested in, they detail the areas covered for each exam and how it is weighted across the questions so that you can work out where to focus your efforts! User: https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-user.pdf Power User - https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-power-user.pdf Cloud Admin - https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-cloud-admin.pdf Please let me know how you get on (Good luck!) and consider accepting this answer or adding karma this answer if it has helped. Regards Will   ... View more

I added the notables to an investigation and was able to add notes as well. However, I'm trying to have an incident number for the incident so that I can use it for tracking purpose. I recently learnt that Splunk ES version 8 provides an incident number along with the investigation we create. I should test this out first, because I'm using Splunk ES version 5. Correct me if I'm wrong. Thanks for your assistance! ... View more