It feels like the limit you are hitting here is a truncate limit in props.conf Can you confirm that it is arriving in Splunk as "_json" sourcetype? If so try running this on the host receiving the HEC: /opt/splunk/bin/splunk btool props list _json --debug | grep -i truncate If it gives 10000 then that is where the limit is being applied! ... View more

Ive recently been working with REST endpoints in this way, it took a bit of head scratching but the process stays running, and can be killed with something like this: sudo kill $(ps -aux | grep -i [\/]opt.*persistconn | awk '{print $2}') Then it will pick up your changes next time you query it. I hope this helps Will  ... View more

Sorry yes, you could use a variety of different regexs depending on what the rest of your data looks like - I missed the numerical digits.. index=your_index sourcetype=your_sourcetype | rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[a-zA-Z0-9_]+) | stats count by dap_record Let me know how you get on! Fingers crossed! Will ... View more

Hi, In terms of general OS hardening and communication between Splunk servers - this will be covered and dealt with by the Splunk team. This page has a section on security which might be appropriate: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2004/Service/SplunkCloudservice A few of the things to note - * You are in control of your own Role-Based-Access-Control (RBAC) policies and procedures, such as ensuring an appropriate password policy is set, users have the right groups etc.  * You cannot use the same MFA options available on-prem (such as Duo) - Instead you should consider using SAML auth and connecting to a system that allows MFA (such as Azure ActiveDirectory).* You're also responsible for the elements that sit outside the SplunkCloud environment, such as heavy forwarders - these will need securing in the usual way. Splunk do provide a client certificate for connecting to the SplunkCloud index tier for sending your data securely. * Only SplunkCloud approved apps can be used. Most apps (typical those not containing any (python) code) will pass automated vetting without any issues, however some may require manual vetting by the CloudOps/Support team who will check it for security compliance etc. This is to protect you from uploading anything that could cause harm to your environment, but also to allow Splunk to provide the level of service promised. I hope this helps!     ... View more

Its funny you mention that because I've just done the exact same using AWS LB and ACM. The logging out of Azure isnt particularly helpful. I also ran into the SSL issue - Azure doesnt allow for non-trusted certificate, there doesnt appear to be a flag to disable. For anyone else running into this issue, ensure that you're webhook is publicly accessible with a  publicly trusted SSL Certificate and that your Azure application has the correct API permissions to configure. the subscription.   ... View more

The first request sounds almost right, but the token has Acknowledgement turned on so need to either turn that off or add a request channel (In curl this would be something like  -H "X-Splunk-Request-Channel: FE0ECFAD-13D5-401B-847D-77883AD77131"     ... View more