Hello! Trying to collect Google Workspace Alert Center events using this app https://splunkbase.splunk.com/app/5556   Input for the alert center successfully connects to the API but it is a very strange significant delay (few hours) between alert entry in Google and its ingestion to the our Splunkcloud. From what I can see in app logs - app works correctly and successfully querying API each 300 seconds. Now I've enabled debug logging, maybe it will help to understand what goes wrong. Any ideas on troubleshooting are appreciated. Second question, there is an ADDON-61892 issue (GWS Alert Center: 'Gmail Phishing' source inputs not working as expected) mentioned in the release notes. Is it possible to get more information on this issue or Splunk issue tracker is private? ... View more

Hi! I'm using Splunk cloud. Trying to create alert to catch event when someone disabling alert. Need advice on the search for this alert, since has no luck with digging into `index=_* disbled_alert_name` ... View more

Hello! I'm using the full-feature AWS Organization. It allows to create an aggregator that contains Config data from all accounts and regions in the organization. Is it possible to get this data into Splunk using Splunk Ann-on for AWS? I can't find a good option for it. Of course, I can create a bucket with all the config data from all accounts, but it requires a lot of effort and seems unreasonable. Maybe it is possible to create an input which utilize  get-aggregate-resource-config  method? It looks much easier to query a single API endpoint than set up data collection from different sources to one place. BTW, it can be a good substitution to Describe with Assume Role inputs.   ... View more

Hi everyone, I am new to Splunk and still learning. Can someone please help me on the below query? My log file: 2020-03-30 12:21:45,075 INFO com.www.yyy.MyClass[ - ] - screen changing to [Select] 2020-03-30 12:25:31,574 DEBUG com.www.yyy.Manager[ - ] - Service- checking 2020-03-30 12:25:31,574 DEBUG com.www.yyy.Manager[ - ] - Service- found 2020-03-30 12:25:31,663 DEBUG com.www.yyy.Manager[ - ] - All Service took 89 milliseconds my requirement: I want to get the screen name and service took time. in the above example I need like this: "Select" screen services took 89 milliseconds Please help me to get the query. I would really appreciate it! Thank you! ... View more

We are using splunk enterprise in our organization. Is it possible to view the alerts created by another user? I went to Reports and Dashboards -> Alerts Clicked on All. Searched for the other user's name in the searchbox but no results come up. Thanks for reading. ... View more

Does Splunk provide measures protecting against / detecting the tampering of the Splunk logs/data? The only thing I could find are the hash values for integrity: https://docs.splunk.com/Documentation/Splunk/8.0.1/Security/Dataintegritycontrol For example, a malicious administrator could add, change, remove or reorder events afterwards. I search for techniques related to tamper-evident logging like forward integrity (by key evolution), hash chains, Merkle tree and linking hash values to public media (blockchain, ...). ... View more