I am experiencing identical problem. Haven't been able to find answer online nor get in contact with Splunk support. Splunk isn't noticing my extra cores after I upgraded instance. Now I'm having performance issues like hot buckets rolling prematurely and the speed of concurrent searches is suffering. ... View more

Ah, I see. Thanks again for the quick response. Must be another issue as I get no results when searching 'cbdefense'. I don't need to use the Carbon Black Event Forwarder utility to generate JSON files from Cb do I? Or is that just for the older add-on when Carbon black was still Bit9? ... View more

Hey thanks for your instructions they really helped, couldn't find much information on how to set this up. Do you know what the best way to see if CB data is coming into splunk? I did all of the above successfully but I dont see any data from the App/add-on. ... View more