I am trying to use the auditd app for Splunk and one of the errors that are thrown is "command="predict", data is not periodic" when trying to generate the Anomalous Event Volume portion of the Security Operations Center dashboard.
Does anyone have any solutions for this?
Are you still receiving this error? It sounds like either the app hasn't yet been configured [correctly] or sufficient auditd events haven't yet been ingested. To confirm that to be the case, please run this search back 24hrs: [|inputlookup auditdindices] [|inputlookup auditdsourcetypes]