Since RBA is all about aggregating security events that are related to the same entity, Assets & Identities normalisation is crucial to...

These 3 table-manipulating commands are occasionally very useful but they are also quite confusing. For years, I've relied on the...

In this post we’re discussing an advanced way to dedup risk events in your risk alerts (RIRs) and at the same time have the RIR results...

This for the most part isn't splunk-specific, but if you do any amount of administration on the linux command line, you might find it...

Assess your search workload with this simple dashboard. Here's a very quick dashboard to identify what uses your splunk platform...

Splunk’s “simple XML” dashboards are reasonably simple and straightforward to create, yet they are incredibly versatile and powerful. You...

I did a talk at Splunk .conf21 about how to maintain correlation searches: pdf / mp4 . One of the topics is Correlation Searches Best...

I did a talk at Splunk .conf21 about how to maintain correlation searches: pdf / mp4 . One of the topics is morning checks. Basically you...

I did a talk at Splunk .conf21 about how to maintain correlation searches: pdf / mp4 . One of the topics is having a simple peer review...

I did a talk at Splunk .conf21 about how to maintain correlation searches: pdf / mp4 . One of the topics is having a simple task...

There are a number of issues with Splunk’s simple XML forms submit button: you can't have more than one you can't move it you can't hide...