Hai can you help with full query to get status if down   index=test_index host="test" (source=ps COMMAND=*cybAgent* OR COMMAND=*event_demon* OR COMMAND=*as_server*) | streamstats current=f last(PID) as lastPID by COMMAND

This is defined in props.conf for the sourcetype, see the  ADD_EXTRA_TIME_FIELDS setting in this documentation https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Timestamp_extraction_configuration

Just updating this old post with the info that we never reached the implementation part of this extension because the client went another route. So my knowledge on this is about as extensive as the above posts. 

Hey @Gaikwad, The error message itself shows what the issue is. The dashboards in the Splunk App for AWS Security are powered by the macro "aws-security-cloudtrail-service". By default, the macro definition is present in the app. However, it doesn't know what index to look into. You can navigate to Settings -> Advanced Search -> Search Macros and locate the macro in the window. Then you'll need to define what index does it need to search to and add the arguments accordingly.  In addition to this, you'll also need to make sure that the permissions to the macro are adequate for a user to access it outside the app or should at least have read access to all the users for the dashboard to load the panels properly. Once the macro is defined with the appropriate index definition and the permissions are properly provided, the dashboard panels will show the expected results.   Thanks, Tejas. --- If the above solution is helpful, an upvote is appreciated. 

Hi @vijreddy30 ... pls check your Profile's inbox.. i have sent a msg to you.  this looks like a POC / test / dev environment setup.  most probably you may not need "high availability" at all.  we may need more details about what you meant by "high availability"..  thanks.   

Hey, Thanks for the info, it was just the management port that needed changing, I picked a different port, finished the installation and everything seems to be working as expected. Thanks again for the information Jamie

In zone-  HF instance and (SH+Indexer) one instance same Zone -2 also. Here my project there is no Deployer, indexer cluster and SH cluster and there is no Cluster master also.   How do i implement High Availability server?

Hi richgalloway, Thank you for reply, I did try as you suggested with lookup command and it didn't work but.... Because of you response I went and tried it again, this time utilizing lower() option and finding it work   Thank you for help 

Thanks alot , i have one more questions ,   I just install misp42 app in my splunk , and add misp instance to splunk , it work      But i want compare from : index=firewall srcip=10.x.x.x , it my log from firewall , so i want compare dstip with ip-dst from misp to detect unusual access activities  , like when dstip=ip-dst : 152.67.251.30 , how can i search this  , misp_instance=IP_Block field=value , i just try some search but it not work:  index=firewall srcip=10.x.x.x | mispsearch misp_instance=IP_Block field=value | search dstip=ip=dst | table _time dstip ip-dst value action It can't get ip-dst from misp instance , Can you help me with this OR can i get some solution to resolve this  Many thanks and Best regards !!