Hi there,  Does any of these Splunk Knowledge Article help?    https://splunk.my.site.com/customer/s/article/Using-the-Splunk-HTTP-Event-Collector-HEC-Video https://splunk.my.site.com/customer/s/article/HEC-Endpoint-and-Test-HEC   ... View more

Hi there,  A  quick search of the Splunk Knowledge base find this article: https://splunk.my.site.com/customer/s/article/AQR-errors-in-internals-logs   Workaround - I. To find the orphaned Knowledge Objects - 1. Select Settings > All configurations. 2. Click Reassign Knowledge Objects. 3. Click Orphaned to filter out non-orphaned objects from the list. 4. After filtering out the Orphaned KO we have to reassign them to the active users. II. Reassign knowledge objects to another owner - 1. For the knowledge object that you want to reassign, click Reassign in the Action column. 2. Click Select an owner and select the name of the person that you want to reassign the knowledge object to. 3. Click Save to save your changes. ... View more

The reason you are getting this message is because the indexers do not have the LOOKUP-SFDC-USER_NAME The following Knowledge Article explains what is happening.  To get off this message I would suggest you open a support case and the Splunk Cloud engineer will be able to address this for you. Robertino     ... View more