Hey! Yeah OTel file exporter can be used.  https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/fileexporter You could also configure otel to filter the data you want and send to file and hec simultaneously! https://github.com/signalfx/splunk-otel-collector/tree/main/examples/otel-logs-routing Splunk otel distro has these components: https://github.com/signalfx/splunk-otel-collector/blob/main/docs/components.md

Hi @scelikok  Hi I have done all the things that you have tell in this communication , still it is not sending logs , can it be an issue of time or cluster, or any other configuration we have to do in helm chart  Your help will be appreciated Thanks

As far as I know, this isn't a feature that's available built in. However, you can make dashboards about it using the notable index. https://lantern.splunk.com/?title=Security%2FUCE%2FPrioritized_Actions%2FCyber_frameworks%2FAssessing_and_expanding_MITRE_ATT%26CK_coverage_in_Splunk_Enterprise_Security outlines some searches that would help you gather that information.

Hi @Ivan.Tamayo, I was doing some digging and found this Documentation I wanted to share: https://docs.appdynamics.com/appd/22.x/latest/en/application-monitoring/install-app-server-agents/net-agent/install-the-net-agent-for-windows/unattended-installation-for-net If I find anything else, I'll be sure to share it with you. 

Last I checked it is still the case that all apps have access to the secret store and have to use controls to limit access.  Came up when working with 1Password on their app. Will poke around and see if any hardening or rework is in the cards this year.... Dev docs have seem to have been updated. https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragerbac/#Configure-role-based-access-to-secret-storage If still think more is needed, hit the feedback link on this doc. dev team has heard this before. glad they have added the docs, but if still need more, good place to start. 

Hi @Eduardo.Rosa, Since the Community has not jumped in, I wanted to share this AppD Documentation that goes into great detail about BTs. https://docs.appdynamics.com/appd/22.x/latest/en/application-monitoring/business-transactions You may need to adjust the documentation for your Controller version number. This can be done at the top right of the page.

Hi @mjohnson_rq - I’m a Community Moderator in the Splunk Community.  This question was posted 4 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you! 

So the issue you are having is the index it lands in correct? It is likely that SC4S hec client is sending a default index.  Hec clients settings in the payload override the settings you put on the token. Think of those as "if not set by the hec client".  https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/FormateventsforHTTPEventCollector#Event_metadata Would check sc4s docs on setting indexes: https://splunk.github.io/splunk-connect-for-syslog/main/configuration/#log-path-overrides-of-index-or-metadata    

"should I do in chunk"? - Yes, use the date ranges to reduce your date range and restore in multiple chunks.  No it will not "reindex it" - https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/Admin/DataArchiver#Restore_archived_data_to_Splunk_Cloud_Platform You can use the "check size" button to make sure your span is under your entitlement. Remember Dynamic Data Active Archive (DDAA)  it is 10% of your Dynamic Data Active Searchable (DDAS), NOT your daily ingest entitlement. Check "cloud monitoring console> license usage > storage summary" Span too wide! too many buckets!: shorten the span, now i can restore!:   reduce your chunk size to under your limit, restore that data, search it, then in the table below you can clear it and restore you next chunk.  Data quality matters here, as if your timestamps are all over the place it can be suprizing how many buckets you have to restore to bring back any give date.  it will not take multiple days to restore this. if you just shrink your window you can do it in steps.  restore > search (tip use collect command to help move what you want to another index) > clear restore > repeat

The LDAP app is compatible with Splunk Cloud so you should be able to install it.  You will need the app on the Cloud SHs for your existing searches to work.  Keep in mind, however, that it requires access to your Active Directory system, which means your AD team must be willing to allow access from your Splunk Cloud search heads (the Internet).  Many AD teams won't allow that.