All Apps and Add-ons

Proofpoint TAP : gap in event ingestion

New Member

I have Proofpoint TAP Modular Input ( set up in a distributed environment. Due to the expiration of the key, we saw a halt in log ingestion into Splunk. Now we have re-inserted the key and log ingestion has resumed. However, we are missing 2-3 days worth of events due to the key issue. Is there a way to define in the TA to ingest logs from a specific start/stop date?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!