Hey @gcusello gcusello, In the o365 add-on , I couldn't find the input for the above mentioned sourcetype. You will have to create an input for that. You can refer this blog for the mentioned input: https://www.splunk.com/blog/2017/10/05/splunking-microsoft-cloud-data-part-3.html Let me know if this helps!! ... View more

Hey @christianubeda, Yes you can set up an intermediate forwarder to send the data across. Please refer this doc: https://docs.splunk.com/Documentation/Splunk/7.3.0/Forwarding/Configureanintermediateforwarder Let me know if this helps!! ... View more

Hi SudarshanS, You may have to contact Splunk support for this. Thanks!! ... View more

Hey @splunkuseradmin , Try using this regex: rex field=_raw "^server:\s\[\w+\]\s:\s{\"\d+\"\s\:\s\[\d+,(?P<conferences>\d+.\d+[^,]),\d+.\d+,(?P<calls>\d+),\d+\]\}" Let me know if this helps!! ... View more

Hey @nick405060 , There are different reason why you want to upgrade your forwarders Version compatibility - If you are using same version for all the components, then it should be fine for you. However, check this link : https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Compatibilitybetweenforwardersandindexers Security Updates if there are any - Splunk securityportal announcements https://www.splunk.com/page/securityportal#announcements New feature update or bug fixes - https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Fixedissues Let me know if this helps!! ... View more

Hey niddhi, Refer this link: https://docs.splunk.com/Documentation/Splunk/7.2.6/Forwarding/Routeandfilterdatad You need to add the filters in props and transforms. You need to add the parameters in the sourcetype stanza(sourcetype = aws:cloudwatch) in the props and transforms. Create this stanza in /opt/splunk/etc/apps/aws/local and not in default. Thou, you will have to verify the path as i am not sure how the app name will reflect. Let me know if this helps!! ... View more

Hey@ijoseph, This TA is not supported by Splunk. For Splunk Cloud customers, the Service Level Commitment and Service Level Credit in the Splunk Service Level Schedule will not apply to issues caused by Not Supported apps or add-ons. https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Splunkbase/Appsupporttypes Let me know if this helps!! ... View more

Hey @sumanssah , Your problem seems to be the first among the listed troubleshooting steps.Refer this doc below: https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/TroubleshootSAMLSSO let me know if this helps!! ... View more

Hey@sarvesh_11, You can refer this answer: https://answers.splunk.com/answers/551802/how-can-i-get-drill-down-working-for-a-trellis-cha.html Let me know if this helps!! ... View more

Hey@yutaka1005, Please refer this doc if u find something relevant. https://docs.splunk.com/Documentation/Splunk/7.2.6/AdvancedDev/TurnOffAutoPause Let me know if this helps!! ... View more

Hey@jip31, Can you try using avg(process_cpu_used_percent) and use bin _time span=1m and then try using where. Let me know if this helps!! ... View more

Hey willsy, Refer the blog and presentation : https://conf.splunk.com/files/2017/slides/cisco-and-splunk-innovation-through-the-power-of-integration.pdf https://www.network-node.com/blog/2017/7/2/cisco-networks-splunk-app Let me know if this helps!! ... View more

Hey@montydo, This seems to be error of bad request.Could you confirm if you are sending request to correct url? https://docs.splunk.com/Documentation/AddOns/released/Box/ConfigurecredentialsonBox Let me know if this helps!! ... View more

Hey vinkumar, Can you try renaming your search? Your problem looks similar to this answer: https://answers.splunk.com/answers/523527/configuration-file-settings-may-be-duplicated-in-m-1.html Let me know if this helps!! ... View more

Hey@paramagurukarthikeyan, Have you tried using this app: https://splunkbase.splunk.com/app/2899/ Let me know if this helps!! ... View more

Hey @anandhalagarasan, Can you check if any splunk process that is running?Kill the process and again freshly install the forwarder. Try referring the below link: https://stackoverflow.com/questions/42448139/how-to-kill-a-specific-task-in-windows-2012-server Let me know if this helps!! ... View more

Hi tarunchawla28, Have you enabled the receiver? Refer this link: https://docs.splunk.com/Documentation/Splunk/7.2.4/AddMSWinCloud/EnableReceiver Also in your search tab can u check index=* and run the query Let me know if this helps!! ... View more

Hey@mdmaala, Yes you can transfer your files from one instance to another. You can try referring this link for migration: https://docs.splunk.com/Documentation/Splunk/7.2.4/Installation/MigrateaSplunkinstance Let me know if this helps!! ... View more

Hey@vikas_baranwal, Are you trying to have each status once instead of repeating multiple times? Can you try using dedup Status? Let me know if this helps!! ... View more

Hey@joelim, I think you need to configure Modular input for audit logs. You can refer this logs: https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureinputs2 Let me know if this helps!! ... View more