https://answers.splunk.com/answers/50048/splunk-consuming-email-alerts-from-other-monitoring-tools.html You'll need a forwarder on premises that can forward into splunk cloud. ... View more

Please check the permissions on the event logs. https://blogs.technet.microsoft.com/janelewis/2010/04/30/giving-non-administrators-permission-to-read-event-logs-windows-2003-and-windows-2008/ ... View more

@bbazian - Were you able to test out somesoni2's updated answer? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks! ... View more

The number of top values shown, for each field is not configurable. There is a workaround but it's not recommended as it involves updating core code of Splunk and any upgrade of Splunk will overwrite it. To expand on the above for the less experienced - if you wish to increase the number of results shown when you click on a field you need to edit this file: {splunk install}/share/splunk/search_mrsparkle/modules/results/SuggestedFieldViewer.conf and add a stansa: [param:count] required = False default = 20 As that this is not a documented feature of the product it's also probably liable to change in future releases without notice. The value of your investment could go up as well as down. ... View more