Looks like I was not completely true. It's more complicated. But there is a way: From transforms.conf.spec file: NOTE: For KV Store lookups, a setting of 'case_sensitive_match=false' is honored only when the data in the KV Store lookup table is entirely in lower case. The input data can be in any case. Context: case_sensitive_match = <boolean> * If set to true, Splunk software performs case sensitive matching for all fields in a lookup table. * If set to false, Splunk software performs case insensitive matching for all fields in a lookup table. * NOTE: For KV Store lookups, a setting of 'case_sensitive_match=false' is honored only when the data in the KV Store lookup table is entirely in lower case. The input data can be in any case. * For case sensitive field matching in reverse lookups see reverse_lookup_honor_case_sensitive_match. * Default: true     ... View more

I never did, no, but I went forward with configuring this myself. I run a test environment for Splunk, so I was able to confirm that there didn't seem to be any adverse affects from running the sensor on my hosts. Since deploying it in production I've had zero issues and zero detections of any kind. I created a dedicated host group with tags to manage my Splunk environment separately (if necessary) but I haven't had to. I have pretty default linux sensor settings and it has been working fine. I'm happy to share any specific configurations I have in place if you need any guidance. ... View more

I have the same issue. Any solution here? Seems that something is missing in the app for on Prem ... View more

The originally required permissions were either Global Administrator or Exchange Administrator.  However, Microsoft has changed that to now allow the Global Reader role. ... View more

Did you find any solution for this? I can see the same behaviour for some other fields but its in a kind of loop to get some Calculated fields disabled and some keys added. Its doing it for 10 to 15 seconds hundrets of times for the same field, sometimes longer, what results in a long search time. It is not doing it for every event. There is not difference if i get 100 events back or 10K. The iteration is done up to a limit i think, or for each index maybe??   ... View more

This likely is tied to the size of your search head dispatch bundles. Try something like:   index=_internal sourcetype=splunkd metrics group=bundles_uploads status=success | stats max(replication_time_msec) AS rep_time BY host peer_name | sort -rep_time   and look for how long the bundles are taking to replicate. If it's consistently longer than 10 secs (10000msec) you likely have some large lookup files or others that are contributing. You can look at commands to blacklist replication or tame the size of your lookups. ... View more