Proofpoint TAP SIEM Modular Input Issue

[aqtran01]

I'm currently running Splunk Cloud, Splunk Enterprise version:10.1.2507.21, in Victoria experience.
I installed the Proofpoint TAP SIEM Modular Input v1.4.1 through the GUI but when going to the Data Input, it is nowhere to be found.

I have submitted a case with Splunk, they were able to successfully do it in their dev environment, but couldn't offer any more help since the App is supported by Proofpoint. So far Proofpoint support has not been helpful. Wondering if anyone has gone through this issue and if there is a fix for it?

Thanks

[aqtran01]

It is on ITSI SH. 

[livehybrid]

Hi @aqtran01 

Is this installed on a regular SH/SHC in SplunkCloud or on a Premium SH (ie for ITSI/ES)? If so I believe inputs can only be configured on the primary non-premium SH/SHC.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing