Please detail what is mean by "it isn't working".  What happens when you try those monitor stanzas?  What errors are reported?  Does the account running Splunk have read access to the files?  Why do you your monitor stanza names end with "AppData" when you want to ingest "AppData\Local\UiPath\Logs"? ... View more

My suggestions were not intended to imply you could choose any one of them.  You must choose from those that apply to the product you want to integrate and not all products will integrate in the same ways.  Few, IME, support HEC. There is an old add-on at https://splunkbase.splunk.com/app/3440 that may help.  Since it's archived, it may not work anymore.  Don't let the lack of support deter you as many splunkbase apps are not supported officially. ... View more

You already have the right idea, just not formatted correctly.  The charting.fieldColors option has to be pairs of strings and hex color numbers.  In the example code, the first string doesn't have a matching color code. ... View more

Usually, this is done with SEDCMD.  The resource use depends on the efficiency of the regex used.  Test the regex on regex101.com and evaluate the resource usage on your dev/test instances. Another option is to use Cribl to remove the unwanted bytes. ... View more

You say you "chose to use a sourcetype".  How did you implement that decision?  It sounds like the add-on is not using that sourcetype.  When you look at the events that have the wrong timestamp, check the sourcetype value associated with them.  That is the sourcetype you need to modify to use DATETIME_CONFIG=CURRENT. ... View more

Installing a modular input on indexers can lead to duplicate data.  Install it on a single SH (not a SHC) or a HF. The app used to define indexes on your indexers should also be installed on your SHs and HFs.  This ensures the UI knows about all indexes. ... View more

I have no other suggestions. ... View more

It's possible the app is out-of-date with Cortex Data Lake.  The app is supported by Palo Alto so you should contact them at https://splunk.paloaltonetworks.com/support.html ... View more

Regex doesn't do negation well, but you can try this EventCode=(?!1102|4616|4624|4625|4634|46484657|4697|4698|4699|4700|4701|4702|4719|4720|4722|4723|4725|4728|4732|4735|4737|4738|4740|4755|4756|4767|4772|4777|4782|4946|4947|4950|4954|4964|5025|5031|5152|5153|5155|5157|5447) ... View more

You can do that using CSS and HTML.  See "Custom Decorations" in the Splunk Dashboard Examples app. ... View more

The difference is the second query uses earliest and latest instead of values for the first_find and last_find fields to avoid multi-value results. ... View more

The ability to copy-paste to or from a browser's address bar has nothing to do with the security of the connection. 127.0.0.1 is the "loopback" address.  It's the standard address used to talk to the local machine.  Port 8089 is Splunk's management port. ... View more

Start learning with the free Splunk online courses.  Find them at https://www.splunk.com/en_us/training/course-catalog.html?search=free There are two Admin courses.  You can find the topics on the course registration pages (you don't have to complete the registration).  See https://education.splunk.com/instructor-led-training/splunk-enterprise-90-data-administration and https://education.splunk.com/instructor-led-training/splunk-enterprise-90-system-administration ... View more

What does the current query give you?  Is the offer field indexed? Have you tried grouping by host_ip? |tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by host_ip ... View more

The concept of more than one "first" or "last" anything baffles me so here is a query that eliminates mutli-value firsts and lasts. index=test sourcetype="issues" | eval first_find=substr(first_find, 1, 10), last_find=substr(last_find, 1, 10) | stats count, values(change_asset) as changed_asset, values(brief) as description, values(severity) as severity, values(exploitation_method) as exploitation_method, earliest(first_find) as first_find, latest(last_find) as last_find, values(systems) as system by id | eval today = strftime(now(), "%Y-%m-%d") | where (match(first_find, today) OR match(last_find, today)) ... View more

Splunk Enterprise and the Splunk forwarders do not support Open Telemetry.  OTEL is the domain of Splunk Observability, which is a different product/service. Ingest Actions are available on indexer as well as HFs, but also do not support OTEL. Consider using Cribl (cribl.io) to transform OTEL data into something Splunk Enterprise can ingest. ... View more

Have you checked the network? ... View more

"not working" and "not able" do not tell us enough to help you.  Please explain what you are trying to accomplish, how (exactly) you are trying to do it, and what the results are.  Include exact error messages.  What platform is Splunk running on?  What browsers are you using and which ones fail?  Are you sure your credentials are correct?  What is "edge"? ... View more

Verify the receiving instance is up, that its queues are not full, and that no network device is blocking connections. ... View more

We've been hoping for that for a long time now.  🙂  Add your voice at https://ideas.splunk.com ... View more