You logs indicate a old pem cert. have you tried renaming the server.pem file under splunk/etc/auth. then restarting splunk service. most KV store isues are resolved with this action.  2022-06-29T15:04:51.149Z F NETWORK [main] The provided SSL certificate is expired or not yet valid. ... View more

If your search period is one minute, try this sourcetype="access_combined" POST 401 "/cas/login" | stats count by clientip | where count > 9 Or if it is larger and you want to check the count in 1 minute buckets, try this sourcetype="access_combined" POST 401 "/cas/login" | timechart span=1m count by clientip | untable _time clientip count | where count > 9   ... View more

Having same issue has anyone found answer on this  ... View more

I'd like to know as well, if anyone found anything. ... View more

That's already set accordingly, however, a few log sources from 1 host are still listed under the Search & Reporting as UTC. ... View more

Great, thanks! Those 2 reasons you gave are the reasons I am separating them out. One group has multiple devices and some are only able to send to default syslog (which other groups have devices like this as well). Since Splunk is not my main job role, I was hoping there would be an "easy" GUI way. ... View more

You can either edit the app and change all the places that say sourcetype="rubrik:eventfeed" OR you can CLONE_SOURCETYPE in transforms.conf ... View more