All Apps and Add-ons

Can we fix a Google Workspace Alert Center ingestion delay?

kimberlytrayson
Path Finder

Hello!

Trying to collect Google Workspace Alert Center events using this app https://splunkbase.splunk.com/app/5556

 

Input for the alert center successfully connects to the API but it is a very strange significant delay (few hours) between alert entry in Google and its ingestion to the our Splunkcloud.
From what I can see in app logs - app works correctly and successfully querying API each 300 seconds.

Now I've enabled debug logging, maybe it will help to understand what goes wrong.

Any ideas on troubleshooting are appreciated.


Second question, there is an ADDON-61892 issue (GWS Alert Center: 'Gmail Phishing' source inputs not working as expected) mentioned in the release notes.
Is it possible to get more information on this issue or Splunk issue tracker is private?

Labels (1)

aldente
Engager

Hi, almost a year late to this thread, but experiencing the same. Has there been any resolution for you?

 

Thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...