Giuseppe, This is an app I installed from Splunkbase and it runs on a heavy forwarder. I don't know if it uses a KV-Store, if the stream is deleted once it is received on the OCI side, or if the checkpoint is in a file on the HF. The app did not have its own inputs screen, instead you had to add it under data inputs and scrolli until you found that entry. It does use a .pem file to make an API connection, but there is no way to know if a checkpoint is in play or not let alone what type. I have not been able to reach the developer, but in all fairness, I only have their old splunk.com address and not their new Cisco address (which is different then what their Splunk one was since I received an NDR attempting to send it to the Cisco domain) so the message may not have been received.  ... View more

I know it has been a while, but did you ever find a solution? I have just encountered this same problem. ... View more

Perhaps related but I have Universal Forwarders that are monitoring a small number of files being written by a dedicated syslog server, but today I noticed some monitored are being processed but others are not. No errors that I have found in the logs, Splunkd.log shows it was processing fine, then didn't show any tail reader entries for the missing files. This is on a Windows server which was patched this weekend and the monitored files are being written. ... View more

  @pgadzhev  Did you ever figure this out? I just ran into it as well. Thanks! ... View more

BP9906, I have I think the same task at hand where my API has a start and end date option. I'd like to leverage the checkpoint to increment the start date in the next API call. My problem is that each JSON reply returns multiple records and the checkpointed field (created date/time) is in each but not necessarily in any order.  As such, I never know which is the latest date/time stamp. Is there a way to find the highest value checkpoint and add 1 second to it for the next API start? How did you handle the increment? ... View more

I guess it requires no major consideration so long as you are running the common information model add-on which creates the data models. There may be more pieces to the puzzle but the network_sessions and authentication data model are both created from within the CIM add-on (link below). I believe this is a heavy hitter so if your Splunk instance is already hitting performance limits during peak usage you may wish to have a conversation before loading this add-on. https://splunkbase.splunk.com/app/1621/ ... View more

I received this information regarding the API's directly from Carbon Black while they were working on a related issue. The current add-on we are all using which is available from Splunkbase leverages API v3. I do not know the differences between v3 & v6 but would be surprised if the parsing of data would not be impacted. Direct quote from Carbon Black: "However, it does appear that the v3 API is considered "deprecated" and the v6 API should be used, so that is something that we should take into consideration for the future and start moving the current API integrations over to the supported version when possible. Please let me know if you have any additional concerns about this." I guess my next step is to chase down who is responsible for items published by the "Carbon Black Developer Network" and see if this is going to be updated or allowed to die on the vine. ... View more

Ditto I too could not get it to work no matter how I tried to set the "field_name_to_join" including with an eval using the same name as the inner search would find. I was so hopeful too! ... View more