I'm trying to onboard data into Splunk Cloud using the Umbrella API via the Cisco Secure Access App for Splunk  (Not Add-on). I have installed the app on Splunk Cloud and configured the Umbrella API integration using the API Key/Secret and Organization ID. However, no data is being ingested, and I’m not seeing any related error logs in the _internal index. I have also verified that the API key has the required permissions/scopes configured.   ... View more

I can't see any dashboard showing numbers (data) in Palo Alto App. - App version 6.1.1 & TA version 6.1.1 - Splunk version 7.2.9 - Data is being ingested from Syslog > UF to Splunk Cloud. - Data can be searched at Splunk from sourcetypes: pan:traffic, pan:system, pan:threat - Data model : pan_firewall is accelerated and built 100%. (there was no data in other datamodels so I  disabled the acceleration on them) one of the search query from dashboard : Network Security  | tstats summariesonly=t count FROM datamodel="pan_firewall" WHERE nodename="log.correlation" GROUPBY log.severity log.threat_category log.threat_name | rename log.* AS * | stats sum(count) AS count by threat_name threat_category severity *I'm wondering the field nodename (not found in the datamodel), is being used in many other panels' search query which might be causing the issue. If so, how to fix that? Please advise. Thanks ... View more

Hi Guys, I'm trying to convert events data into metric for CPU, Disk, Memory monitoring for Azure PAAS, using below command. index=azure_data metric_name=cpu_percent | eval metric_name=case(metric_name="cpu_percent", "%_Processor_Time")| eval _value=maximum | fields host,metric_name,namespace,_time,_value | eval prefix="Processor." | mcollect index=azure_metrics_summary prefix_field=prefix *here I'm trying to use mcollect to send CPU data to summary index "azure_metrics_summary ". Query is running with no error but not showing _value field in the output and when I'm running below command to search metrics data , Not seeing any output. | mstats avg(_value) count where metric_name="Processor.%_Processor_Time" index=azure_metrics_summary by host ... View more

How do I delete SAML users from Search Head Cluster? I tried removing from stand-alone Search Head(Dev environment) using below command, successfully did that. curl -k -u admin:{password} --request DELETE https://{..hostname}:8089/services/admin/SAML-user-role-map/{user_id} and then manually delted user directory from /splunk_home/etc/users/ But, when I'm running this command at SH cluster(production) it is giving me error: curl: (7) Failed to connect to URI port 8089: connection time out ... View more