can you provide an example values.yaml with what you have in mind?  Are you saying it should be this code below? if so, this yaml seems to output gateway logs but its not getting picked up and sent through to splunk. clusterName: CHANGEME splunkObservability: realm: CHANGEME accessToken: CHANGEME gateway: enabled: true replicaCount: 1 resources: limits: cpu: 2 memory: 4Gi agent: enabled: false clusterReceiver: enabled: false logsCollection: containers: excludeAgentLogs: false  

Hi @FPERVIL, see this document that answers to your requisite: https://docs.splunk.com/Documentation/Splunk/9.2.0/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups Ciao. Giuseppe

Hi Ricfez,   sorry i forgot to add more detail to this but no the ip hasn't changed or the hostname of the firewalls, running a tcpdump i can see the logs are hitting my Sc4s(on-prem) to our splunk could instance  , however on the fw themselves the format of the logs were set as "splunk" maybe this could have an effect? 

Hi @uagraw01, if, in the same period, you're receiving the other logs in the other not internal indexes, this means that you have a congestion of data and internal logs (having a minor priority) are skipper, check the queues in your Forwarders. Ciao. Giuseppe

Hi @SplunkExplorer  > Where it sends logs? Directly to Indexers? To a HF? A Splunk UF generally will send the logs to indexer. but if your indexer is overloaded and if you want to do some preprocessing beforehand, then you should use a HF(from UF, send the logs to HF.. HF will do some parsing tasks, then it will send the logs to indexer) > A UF is installed on it? If not, how it send logs? WMI? WEF? Other yes, WMI options is available. and if you can not install the UF, then you can use a syslog server to collect the logs from all systems that dont have UF and send it to a HF or indexer.. 

Changing MAC address shouldn't probably affect anything, but changing IP addresses might. In any case, I'd start with your firewall - how is it configured to send syslog, to what address specifically? Is it actually doing so?  You basically just need to follow the path the data is supposed to take and find out where it's failing. That may lead directly to Splunk Cloud, with Splunk Cloud listening on a network port.  https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/HowSplunkEnterprisehandlessyslogdata In that case you might have to adjust the IP allow list in Splunk Cloud.  https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Config/ConfigureIPAllowList It's also possible the device is sending its logs to a local syslog server, which has a splunk forwarder installed and which then sends the logs in to Splunk.  If that's the case, then the problem is most likely with the firewall - either as mentioned earlier it's not actually sending syslog, or I guess it's also possible in the firewall swap a rule or two has been missed. And if that's the case (FW -> syslog locally, Splunk forwarder -> Splunk Cloud) it's not likely anything in the last half of that is broken but you could check for something simple like a forwarder that just got all jammed up and confused and needs a restart. But as mentioned - start with your firewall's syslog settings and work your way through the syslog data flow and I'm sure you'll find it.

Hi @lbrhyne, I also opened a case to Splunk Support and thay said that this behavior is all normal! Please push also you so maybe they will understand! I'm discussing with them because for me this is a bug, also because, if you create a field extraction, using the regex101 regex (it's the only one that runs in field extractions!) and then you try to use the IFX, you'll have a red error! Ciao. Giuseppe

@gcusello Thank You! Your solution worked, partly. At search time this worked perfectly:  Using - nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\\\w+\\\\\w+\\\\\w+\\\\\w\d+\:\d+\-\d+\:\d+\\\\\w+\\\\\w+\\\\\w+\\\\\w(?P<Successful>\d+) However, neither the regex above or the following worked as a field extract:  Regex101 - nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\w+\\\w+\\\w+\\\w\d+\:\d+\-\d+\:\d+\\\w+\\\w+\\\w+\\\w(?P<Successful>\d+) I have opened up a ticket with Splunk to see  if they can figure it out. For now I will be using the search time extraction. If Splunk provides a solution, I will post an update.

We noticed this TA error issue on Splunk Cloud as soon as this TA was installed. So there is no license issue in our environment.  A quick test is to install this TA in a valid licensed environment and see it break search. The OP may have had a coincidental License error.