Hi, please can you share how exactly were you monitoring the share  If you can share how it was mounted and then how you configured the UF to see the share/file Was is just normal add data and monitor a local file ( which was the mount actually) ? thanks ... View more

Did you ever have luck solving this? I am on that version as well and having the same issue. ... View more

Perfect, that works fine to me. ... View more

IIS logs by default don't cover all the items needed for this app. If you go into your IIS instance and adjust the fields logged to include: Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken ... View more

This ended up being close to the correct query. Thank you for the assistance. ... View more

Yes, this was an issue on the checkpoint side. Not Splunk issue. ... View more