Splunk Crowdstrike Logs Ingestion

Splunk Enterprise

Hello Team,

We have installed Crowd strike Add on 1.0.7 and ingested the logs via API in Splunk, Challenge we are facing every week logs are stop reporting to Splunk and manually we need to refresh the connection from Splunk, Can you please help why this issue is happened.

Is there any bug in Add on or do we need to set the limit in Crowdstrike add on to refresh the connection?

Thanks,

Sahil

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...