If you are trying to find the alerts coming from Microsoft Defender for Identity, you can gather the alerts via the MS Graph Plugin found here: https://splunkbase.splunk.com/app/4564#Configuring-Microsoft-Graph-Security-data-inputs    

Hi! I know I'm late but I've always wondered this as well... From the Components and their relationship with the network section of the Inherit a Splunk Enterprise Deployment documentation, this is loopback communication, meaning you won't need to open any ports. Splunk is talking to the local KV Store database (mongod). If I run an lsof for open ports, I see the following all occurring over the loopback interface (8065 shows a similar result, only showing Python as the listening service):  

Hi @Sagar.Nalawade, Please have a read of these AppD Docs pages https://docs.appdynamics.com/appd/onprem/24.x/24.3/en/events-service-deployment/events-service-requirements https://docs.appdynamics.com/appd/onprem/24.x/24.3/en/events-service-deployment Let me know if these help you out.

Hi @sajo.sam, I found this TKB article. Please check it out and see if it helps. https://community.appdynamics.com/t5/Knowledge-Base/How-do-I-debug-common-Linux-Private-Synthetic-Agent-issues/ta-p/51547

Hi @Jerg.Weick, I've shared this with the PM, and it's being investigated whether it's a bug. I will report back here when I have any new information. ^ Posted was edited by @Ryan.Paredez to correct my initial reply. 

{ "correlationId" : "43b856a1", "message" : "Post - Expense Extract processing to Oracle", "tracePoint" : "FLOW", "priority" : "INFO" } { "correlationId" : "43b856a1", "message" : "After calling flow SubFlow", "tracePoint" : "FLOW", "priority" : "INFO" } { "correlationId" : "43b856a1", "message" : "PRD(SUCCESS): Concur AP/GL Extract- Expense Report. Concur Batch ID: 450 Company Code: 725 Operating Unit: AB_OU", "tracePoint" : "FLOW", "priority" : "INFO" } { "correlationId" : "19554d60", "message" : "PRD(SUCCESS): Concur AP/GL Extract - Expense Report. Concur Batch ID: 398 Company Code: 755 Operating Unit: BZ_OU", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "19554d60", "message" : "Concur AP/GL File/s Process Status", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "19554d60", "message" : "PRD(SUCCESS): Concur AP/GL Extract - Expense Report. Concur Batch ID: 398 Company Code: 725 Operating Unit: AB_OU", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "19554d60", "message" : "Before calling flow post-PInvoice-SubFlow", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "9a1219f2", "message" : "Before calling flow post-APInvoice-SubFlow", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "9a1219f2", "message" : "PRD(SUCCESS): Concur AP/GL Extract - AP Expense Report. Concur Batch ID: 95", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "9a1219f2", "message" : "Post - Expense Extract processing to Oracle", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "9a1219f2", "message" : "Concur Process Status", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "9a1219f2", "message" : "ISG AP Response", "tracePoint" : "FLOW", "priority" : "INFO", } { "correlationId" : "9a1219f2", "message" : "After calling flow post-APInvoice-SubFlow", "tracePoint" : "FLOW", "priority" : "INFO", }

thanks, it worked   One more request, since I am new to splunk, could you please help me understand how this regular expression works, I mean what does this means in a regex expression: | rex field=TeamWorkTimings "(?<TeamStart>[^-]+)-(?<TeamEnd>.*)"