Running into the same modular loading issue. Installing on HF on-prem and this issue is occurring.    With Py 2 being given an official end-date, I would like to know if there the community has found a way to get this working on Py3. ... View more

Hi @ranade , I'm afraid I don't have a reply for this one yet, but I'd like to get back to you once we implement it! May I inquire if you have a link to documentation for your solution to send "Cortex XDR sending data via TCP SSL to Splunk"? Is that just a standard TCP-Input on Splunk side?  https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports My Security team is indicating that Cortex-XDR is only capable of API. Thanks! ... View more

I'm assuming the regex is fine, as you seem happy with that, so in terms of efficiency, if this is a one-off operation, does efficiency matter? Your query is searching yesterday. Is the intention that it searches further back than that? Could you just run a backfill operation and let Splunk handle the scheduling? If you're looking for a general solution, then you could output each production index search to a CSV (outputlookup append=t) and then after running all the searches, just inputlookup the csv and stats count on the data. ... View more