Hi there!  I'm wondering if anyone out there has experience with using Data Manager for Azure onboarding. According to this link https://docs.splunk.com/Documentation/DM/1.7.0/User/GDIOverview#Getting_data_in_for_Microsoft_Azure it shows that there are only TWO supported sourcetypes, azure:monitor:aad and azure:monitor:activity. The searches for Enterprise Security Analytic Stories for Azure uses a macro named azuread which is looking for a specific sourcetype (mscs:azure:eventhub).  Does DM contain that sourcetype needed for the ES stories?  Or will I still need to be ingesting eventhub via the Splunk Add-on for Microsoft Cloud Services TA?         ... View more

I'd like to play with the BOTS v3 dataset.  It requires Enterprise 7.1.7 and downloading of older releases does not show anything before version 8.  Does anyone how to get this older version of Splunk Enterprise?  Thanks! ... View more

I've uploaded a lookup csv file, and was immediately able to use it from a inputlookup and lookup (referencing the file). I'm wondering why a lookup definition is needed to be set per the instructions from the Search tutorial? https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchTutorial/Usefieldlookups "It is not sufficient to share the lookup table file with an application. You must define the information in the lookup table file and how that information relates to the fields in your events. This is called a lookup definition. ... View more